flightsim
flightsim copied to clipboard
New module: base64-dns
As per https://github.com/krmaxwell/dns-exfiltration we should synthesize Base64 encoding and exfiltration of data to hostnames under base64.alphasoc.xyz, as below:
- Generate a long random binary value from
/dev/randomor similar - Chop the value into pieces and encode each with Base64
- Ship each piece out over DNS (e.g.
AAAAAAAAAAAxMjM0NTY3OA==.base64.alphasoc.xyz)
Module description for the table in the documentation as below.
| Module | Description |
|---|---|
base64-dns |
Exfiltrates Base64-encoded data over DNS to *.base64.alphasoc.xyz |
We should probably rename sandbox.alphasoc.xyz to tunnel.alphasoc.xyz too. Thoughts?
This is a lower priority as it is blocked by https://github.com/alphasoc/riswiz/issues/321.