iagox86/dnscat2
Dnscat2
dnscat2 is a DNS tunneling tool and covert command and control server that encapsulates encrypted traffic within DNS queries and responses. It functions as an encrypted DNS proxy designed to bypass network firewalls and establish communication paths when standard outbound ports are blocked.
The project enables the creation of covert network channels by acting as an authoritative nameserver. It supports remote command execution through interactive shells and provides a mechanism for tunneling TCP network traffic to reach restricted remote hosts.
The system includes capabilities for multiplexed session management to organize concurrent client connections and utilizes pre-shared keys to secure data payloads. It further supports network perimeter evasion by routing TCP connections from local ports to remote destinations via the established DNS channel.
Features
- DNS Tunnels - Encapsulates application data within DNS record requests and responses to bypass network firewalls.
- DNS Tunneling Proxies - Provides a secure, encrypted proxy that encapsulates traffic within DNS protocols to bypass network restrictions.
- Authoritative Name Servers - Implements a custom authoritative nameserver to intercept and decode specially crafted DNS queries.
- Covert Domain Delegations - Delegates DNS queries to a custom server via a domain registrar to create a covert communication path.
- Concurrent Remote Session Managers - Organizes concurrent client connections into separate interactive windows for command execution.
- TCP-over-DNS Tunneling - Wraps raw TCP streams into chunks of DNS data to provide network-level connectivity.
- Covert Backdoors - Maintains hidden communication links between clients and servers using non-standard DNS channels.
- Defense Evasion - Establishes covert paths to remote systems to bypass security policies when outbound ports are blocked.
- Multi-Protocol Command and Control - Provides command and control infrastructure that uses the DNS protocol for stealthy remote management.
- Remote Command Execution Tools - Manages interactive shells and executes commands on remote hosts through a DNS-based tunnel.
- Connection Multiplexing - Tracks multiple concurrent client connections through unique identifiers to route traffic to separate interactive shells.
- Remote Port Forwarding - Maps local server ports to remote hosts by tunneling traffic through a DNS channel.
- Secure Communication Channels - Protects data streams between endpoints using cryptographic keys and pre-shared secrets.
- TCP and UDP Forwarders - Routes raw TCP network packets from local ports to remote destinations via a DNS channel.
- Symmetric Encryption - Secures data payloads within DNS packets using symmetric cryptography with pre-shared keys.
- Extensible Architectures - Provides a pluggable architecture to add new communication protocols or features without modifying core tunnel logic.
- Exfiltration Tools - Creates encrypted command and control channels over DNS.
- Command and Control - Establishes stealthy C2 tunnels using legitimate DNS traffic.
- Command And Control Frameworks - Encrypted command and control channel over the DNS protocol.
- Credential Harvesting - Exfiltrates data over DNS.
- Forensics Analysis - Hosts communication through DNS tunnels.
- Network Tunneling and Proxying - Tool for command-and-control over DNS.
- Tunneling and Proxying - Tool for establishing C2 channels via DNS tunneling.
