{"id":4276,"date":"2016-12-20T01:42:55","date_gmt":"2016-12-19T17:42:55","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4276"},"modified":"2016-12-20T01:43:09","modified_gmt":"2016-12-19T17:43:09","slug":"dnsteal-dns-exfiltration-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/12\/dnsteal-dns-exfiltration-tool\/","title":{"rendered":"dnsteal &#8211; DNS Exfiltration Tool"},"content":{"rendered":"<p>dnsteal is a DNS exfiltration tool, essentially a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/09\/dnsteal-DNS-Exfiltration-Tool-640x274.png\" alt=\"dnsteal - DNS Exfiltration Tool\" width=\"640\" height=\"274\" class=\"aligncenter size-medium wp-image-4371\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/09\/dnsteal-DNS-Exfiltration-Tool-640x274.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/09\/dnsteal-DNS-Exfiltration-Tool.png 1019w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>dnsteal is coded in Python and is available on Github.<\/p>\n<h3>Features<\/h3>\n<p>dnsteal currently has:<\/p>\n<ul>\n<li>Support for multiple files<\/li>\n<li>Gzip compression supported<\/li>\n<li>Supports the customisation of subdomains<\/li>\n<li>Customise bytes per subdomain and the length of filename<\/li>\n<\/ul>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<h3>Usage<\/h3>\n<pre># cd dnsteal\/\r\n# .\/dnsteal.py -h\r\n \r\n      ___  _  _ ___ _            _ \r\n     |   \\| \\| \/ __| |_ ___ __ _| |\r\n     | |) | .` \\__ \\  _\/ -_) _` | |\r\n     |___\/|_|\\_|___\/\\__\\___\\__,_|_|v2.0\r\n\r\n-- https:\/\/github.com\/m57\/dnsteal.git --\r\n\r\nStealthy file extraction via DNS requests\r\n\r\nUsage: python .\/dnsteal.py [listen_address] [options]\r\n\r\nOptions:\r\n        -z      Unzip incoming files.\r\n        -v      Verbose output.\r\n        -h      This help menu\r\n\r\nAdvanced:\r\n        -b      Bytes to send per subdomain                 (default = 57, max=63)\r\n        -s      Number of data subdomains per request       (default =  4, ie. $data.$data.$data.$data.$filename)\r\n        -f      Length reserved for filename per request    (default = 17)\r\n\r\n$ python .\/dnsteal.py -z 127.0.0.1\r\n\r\n-------- Do not change the parameters unless you understand! --------\r\n\r\nThe query length cannot exceed 253 bytes. This is including the filename.\r\nThe subdomains lengths cannot exceed 63 bytes.\r\n\r\nAdvanced: \r\n        .\/dnsteal.py 127.0.0.1 -z -s 4 -b 57 -f 17      4 subdomains, 57 bytes => (57 * 4 = 232 bytes) + (4 * '.' = 236). Filename => 17 byte(s)\r\n        .\/dnsteal.py 127.0.0.1 -z -s 4 -b 55 -f 29      4 subdomains, 55 bytes => (55 * 4 = 220 bytes) + (4 * '.' = 224). Filename => 29 byte(s)\r\n        .\/dnsteal.py 127.0.0.1 -z -s 4 -b 63 -f  1      4 subdomains, 63 bytes => (62 * 4 = 248 bytes) + (4 * '.' = 252). Filename =>  1 byte(s)\r\n\r\n\r\n# <\/pre>\n<p>You can download dnsteal here:<\/p>\n<p><a href=\"https:\/\/raw.githubusercontent.com\/m57\/dnsteal\/master\/dnsteal.py\">dnsteal.py<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/m57\/dnsteal\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>dnsteal is a DNS exfiltration tool, essentially a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. dnsteal is coded in Python and is available on Github. Features dnsteal currently has: Support for multiple files Gzip compression supported Supports the customisation of subdomains Customise bytes per subdomain [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"dnsteal is a DNS exfiltration tool, essentially a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9,5],"tags":[401,3265,9755,215,284],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4276"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4276"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4276\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}