DNS-Shell

DNS-shell DNS-Shell is an interactive Shell over DNS channel. The server is Python based and can run on any operating system that has python installed, the payload is an encoded PowerShell command. Understanding DNS-Shell The Payload is generated when the sever script is invoked and it simply...

dnscat2

NOTE: The password for the .zip downloads are all "password"! Introduction Welcome to dnscat2, a DNS tunnel that WON'T make you sick and kill you! This tool is designed to create an encrypted command-and-control C&C channel over the DNS protocol, which is an effective tunnel out of almost every...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

DNS-Tunnel-Keylogger

DNS Tunnel Keylogger This post-exploitation keylogger will covertly exfiltrate keystrokes to a server. These tools excel at lightweight exfiltration and persistence, properties which will prevent detection. It uses DNS tunelling/exfiltration to bypass firewalls and avoid detection. Server Setup T...

DNS_Tunneling

Intro Inspired by recent work I did involving Cobalt Strike DNS beacons, in conjunction with a mission statement to try and evade Microsoft Defender for Endpoint, I spent some time looking into how DNS might be used to transfer a payload to a target machine. I further wanted to challenge myself b...

dns-black-cat

DNS-Black-CatDBC Multi-platform toolkit for an interactive C2C DNS shell, by using DNS-Black-Cat, you will be able to execute system commands in shell mode over a fully encrypted covert channel. Server ported as a python script, which acts as DNS server with required functionalities to provide...

Pulsar

Pulsar Pulsar is a tool for data exfiltration and covert communication that enable you to create a secure data transfer, a bizarre chat or a network tunnel through different protocols, for example you can receive data from tcp connection and resend it to real destination through DNS packets 🎉...

flightsim

网络飞行模拟器 flightsim 是一个轻量级工具，用于生成恶意网络流量，帮助安全团队评估安全控制和网络可见性。该工具执行测试以模拟 DNS 隧道、DGA 流量、向已知活跃 C2 目的地的请求以及其他可疑流量模式。 安装 从 GitHub Releases 页面下载适用于您操作系统的最新 flightsim 二进制文件。或者，可以在任何环境（例如 Linux、macOS、Windows）中使用 Golang 构建该工具，如下所示： go install github.com/alphasoc/flightsim/v2@latest 运行网络飞行模拟器 安装后，按如下方式测试...

iodine

iodine - https://code.kryo.se/iodine This is a piece of software that lets you tunnel IPv4 data through a DNS server. This can be usable in different situations where internet access is firewalled, but DNS queries are allowed. COMPILING To compile iodine you need meson. Run the following commands...

Network_Assessment

Network Assessment With Wireshark or TCPdump, you can determine whether there is harmful activity on your network traffic that you have recorded on the network you monitor. This Python script analyzes network traffic in a given .pcap file and attempts to detect the following suspicious network...

NetworkAssessment

NetworkAssessment: Network Compromise Assessment Tool The Network Compromise Assessment Tool is designed to analyze pcap files to detect potential suspicious network traffic. This tool focuses on spotting abnormal activities in the network traffic and searching for suspicious keywords. Features D...

rita

RITA（实时智能威胁分析） 如果您从RITA中获得了价值，并希望进一步实现狩猎自动化、未来可视化及数据增强，那么请查看 AC-Hunter。 由 Active Countermeasures 为您呈现。 由 BHIS 赞助。 RITA 是一个用于网络流量分析的开源框架。 该框架支持以 TSV 或 JSON 格式导入 Zeek 日志，目前主要支持以下功能： 信标检测 ：搜索网络内部和外部的信标行为迹象 长连接检测 ：轻松查看长时间通信的连接 DNS 隧道检测 ：搜索基于 DNS 的隐蔽信道迹象 威胁情报源检查 ：查询威胁情报源以搜索可疑域名和主机 快速开始 请参阅我们推荐的...

ThunderDNS

ThunderDNS 该工具可以通过DNS协议转发TCP流量。支持非编译客户端 + socks5。 运行 在我们的域名上设置NS记录： 请等待DNS缓存清除。 简易服务器运行： python3 ./server.py --domain oversec.ru 简易服务器运行（Dockerfile）： docker run -e DOMAIN='' 简易客户端运行（Bash）： bash ./bashclient.sh -d oversec.ru -n 简易客户端运行（PowerShell）： PS: ./psclient.ps1 -domain oversec.ru -clientname...

dnschan

dnschan Este es un troyano que se ejecuta a través de DNS. Puedes: manejar múltiples agentes muy lentamente subir archivos obtener archivos de la web ejecutar procesos...

siphondns

SiphonDNS Un PoC para las técnicas descritas en esta investigación. Implementa la exfiltración de datos mediante secciones no estándar de DNS. Servidor: $ ./siphondns-server -method ecs Starting DNS server cmd id Command received Receiving...

DNSlivery

DNSlivery Entrega sencilla de archivos y payloads a través de DNS. DNSlivery Agradecimientos Descripción TL;DR ¿Qué problema intenta resolver? ¿Cómo funciona? Requisitos Configuración Zona DNS DNSlivery Uso Servidor Objetivo Agradecimientos Este proyecto fue inspirado originalmente por PowerDNS y...

Tourmaline

Tourmaline I recently stumbled upon a piece of cleverly designed malware that calls itself "Tourmaline". This README is very kindly written by Claude as I was super busy with exams at the time of this repository's inception. Exploiting and decrypting this malware took a huge chunk of my time from...

dnscat2-powershell

dnscat2 is a DNS covert channel tool by @iagox86 Ron Bowes which is used to transfer data over DNS requests. This is a powershell version of the dnscat2 C client. Click here for a blog post that gives a more detailed breakdown of the purpose of this script, and how to use it. To use this script,...

DNSlivery

DNSlivery Easy files and payloads delivery over DNS. DNSlivery Acknowledgments Description TL;DR What problem are you trying to solve? How does it work? Requirements Setup DNS Zone DNSlivery Usage Server Target Acknowledgments This project has been originally inspired by PowerDNS and Joff Thyer's...

Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...