Skip to content

BoD: Bytes Over DNS#

hack.lu 2025 digest Program Adjacent pick 21–24 October 2025

Abstract Recording

Didier Stevens

Play the recording: BoD: Bytes Over DNS

  • Why: DNS remains the most reliable egress channel, and knowing which public resolvers forward arbitrary bytes changes the calculus for DNS egress policy.
  • What: Some DNS servers (1.1.1.1 named) accept and forward any byte values inside DNS packets, enabling a C2 channel with higher throughput than hexadecimal encoding, despite label formats being nominally limited to letters/digits/hyphen. Scripts are shared for attendees to test resolvers of their own choosing. (from abstract only)
  • How: Abusing permissive label handling in DNS implementations that accept more than the LDH character set.
  • Where applicable: Any environment where clients can reach open recursive resolvers; a short overview-format talk — quick but practical.