BASE64 Over DNS – SANS Internet Storm Center
Posted by jpluimers on 2026/08/31
Interesting back-channel: [Wayback/Archive] BASE64 Over DNS – SANS Internet Storm Center covered in the blog
- [Wayback/Archive] SANS Stormcast Wednesday, September 3rd, 2025: Sextortiion Analysis; Covert Channel DNS/ICMP; Azure AD Secret Theft; Official FreePBX Patches
- [Wayback/Archive] MystRodX: The Covert Dual-Mode Backdoor Threat
It reminds me over other tunneling techniques over DNS like the below VPN over DNS one that have existed for quite a while now (for instance in Captive portal: DNS Tunneling).
Last year, it raised attention because of [Wayback/Archive] MystRodX: The Covert Dual-Mode Backdoor Threat.
Nothing new though, but still interesting (:
Anyway, some links on stuff that has existed for a while:
-
- [Wayback/Archive] VPN-over-DNS which is open source at [Wayback/Archive] GitHub – AlexandreFenyo/vpn-over-dns: tunneling software over DNS: Java server, GUI and command-line clients for Android, Windows, Mac OS X & Unix/Linux with a first commit in 2016.
- [Wayback/Archive] Detection, analysis and measurement of DNS tunnelling techniques | SIDN Labs which has the dissertation at [Wayback/Archive] Masters_Thesis_2024_Damianos_Nikou_s1083196.pdf [Wayback PDF View/PDF View]
--jeroen
The Wiert Corner - irregular stream of stuff 
Leave a comment