• 0 Posts
  • 37 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2023

help-circle












  • When a remote code execution exploit is run, you often have a very limited payload you can deliver. Usually that means delivering a small downloader that then downloads and installs a backdoor from somewhere on the Internet

    The standard counter-measure to protect your servers is to block all outbound traffic unless it’s to a known safe destination. Downloading the secondary payload over DNS gets around that since you can’t just block DNS. Tools to protect against this or DNS tunneling are still relatively new, so a lot of people haven’t implemented them yet.