Data Exfiltration

DNS data exfiltration uses DNS queries to extract data from environments where direct outbound connections are blocked. Since DNS traffic is rarely filtered, it provides a reliable out-of-band channel.

DNS tunneling encodes data into subdomain labels of a query, sending it to an attacker-controlled authoritative nameserver. Tools like dnscat2 and iodine build full tunnels over DNS. Simpler approaches encode small payloads (credentials, command output) into TXT or A record lookups, using a Burp Collaborator or custom listener to capture the data.