1. DNS Tunneling

2. 1
What is DNS?

3. Domain Name System
The Domain Name System (DNS) is used to resolve human-readable hostnames into machine-readable IP addresses.

4. 2
How does DNS Works?

5. How Does DNS Works?
When you visit a domain such as ”facebook.com”, your computer follows a series of steps to turn the human-readable web address into a machine-readable IP address.

6. Request to a local DNS server

7. From local DNS to a root DNS server

8. From root DNS to a TLD DNS server

9. From TLD to Authoritative DNS server

11. DNS has a POWERFUL Passport!

12. The Concept of DNS Tunneling3
The Concept of DNS Tunneling

13. DNS Tunneling
DNS tunneling is the ability to tunnel another protocol through DNS.
DNS tunneling can be used for:
Command and Control.
Data exfiltration.
Tunneling any IP traffic.

14. Tunnel Components A controlled domain or subdomain.
A sever where to install DNS tunneling software.
A client side component.
Data encoded in DNS payload. 
Some of the encoding techniques:
Base32 Encoding.
Base64 Encoding.

15. Request to a local DNS server
The PC encodes the message in a DNS payload.

16. From local DNS to a root DNS server

17. From root DNS to a TLD DNS server

18. From TLD to Authoritative DNS server
The authoritative DNS decodes the message and send the actual request to the internet.

19. From Authoritative DNS server to the Internet

20. From Authoritative DNS server to the DNS Client
The authoritative DNS encodes the message and sends it as DNS reply.

21. Decodes the Message The PC decodes the message That is inside
the DNS reply.

23. Detecting DNS Tunneling4
Detecting DNS Tunneling

24. Frequency of DNS Requests

25. Existing DNS Tunneling Tools5
Existing DNS Tunneling Tools

26. DNS Tunneling Tools
SlowDNS.
Iodine.
OzymanDNS.
Heyoka.
DNScat (DNScat-B).

27. An application that tunnels your data over DNS Tunnel.
Demo using SlowDNS
An application that tunnels your data over DNS Tunnel.
Android App on Google Play.

28. Any Questions?