The Domain Name Service (DNS) allows machines to convert human readable
domain names like google.com into their machine addresses. In this post,
I talk about how DNS tunneling works and present some content that I put
together to aid analysts in dete...
Hackers are people too. Sometimes it is difficult to remember that fact
based on the Hollywood attack stories we may hear on the news, in
presentations and ghost stories. But it is true, hackers are people.
They know how they want things done, and th...
Hey Kevin, I have done similar things, but nothing exactly the same. Try
this though: NwConsole -c login {ip:port} {username} {password} -c send
sdk/ values "size={however many results you want} fieldName=sessionid
where="device.type = 'unknown'" --o...
Hey Volodymyr, You make a good point about IDNA encoded domains. I
wasn't thinking of those. It would be interesting to test with some of
those encoded domains to see how it affects the results. My guess is
that since everything is still being encode...
It is excellent that you have DNS logs. Using logs can be much better
than packets for this use case because you get an accurate number of
source IPs for each requested domain. So, assuming that DNS is only
allows out of your firewall from the DNS se...
