Data exfiltration: DNS tunneling vs ICMP tunneling?

27 Haz 04:19

On this kind of engagement, I rarely hesitate between the two methods: **ICMP tunneling** remains my favorite for the *invisible* and *persistent* aspect. I often use **ptunnel-ng** (for its simplicity) paired with a homemade Python script to encode data in base64 before sending. The big advantage? ICMP Echo Request/Reply packets pass everywhere, even in strict networks where outbound DNS is filtered. Just watch out for heavy ICMP logs in some SOCs—I’ve had to adjust ping frequency multiple times to avoid automatic triggers. For DNS tunneling, the **dnscat2** + **iodine** combo is solid, but I’ve struggled more than once with request size limits (max 255 bytes per subdomain). I’ve also tested **DNSExfiltrator** for quick PoCs, but latency can become an issue fast if you’re trying to exfil heavy files. My personal tip: compress data with gzip before sending and split it into chunks. And *always* check the target’s split DNS rules—I once wasted three days because of a misconfigured wildcard DNS…