exfiltrate

README

exfiltrate

A growing collection of data exfiltration techniques for testing firewall and NIDS rules.

Documentation

Index

• func DNSQueryA()
• func DNSQueryTXT()
• func DNSSendA()
• func DNSSendTXT()
• func DNSServ()
• func ICMPRecvPingv4() error
• func ICMPSendPingv4(payload string, recvAddr string) error
• func ViaResolver(dnsConfig DNSConfig, msg string)
• type DNSConfig

Functions

func DNSQueryA

func DNSQueryA()

DNSQuery sends a request for A record types. This can be used as a test weather arbitrary DNS severs are allowed

func DNSQueryTXT

func DNSQueryTXT()

DNSQueryTXT sends a request for TXT record types. This can be used to get commands from a c&c server.

func DNSSendA

func DNSSendA()

DNSSendA sends responses for A record type queries.

func DNSSendTXT

func DNSSendTXT()

DNSSendA sends responses for TXT record type queries.

func DNSServ

func DNSServ()

DNSServ is a server listening for DNS requests

func ICMPRecvPingv4

func ICMPRecvPingv4() error

ICMPRecvPingv4 listens for IPv4 ICMP pings and reads the data field.

func ICMPSendPingv4

func ICMPSendPingv4(payload string, recvAddr string) error

ICMPSendPingv4 sends a IPv4 ping with arbitrary data in the data field. Ping is of type echo. We don't care for the answer here.

func ViaResolver

func ViaResolver(dnsConfig DNSConfig, msg string)

ViaResolver creates a local resolver where we can set the DNS server, i.e. the c&c server. It sends the msg as a A record request to the set DNS server. The message is the domain we fake to resolve. Easy test but might be interessting in some cases.

Types

type DNSConfig

type DNSConfig struct {
	Address string // cc server
	Port    string // cc dns port
	Proto   string // cc dns proto. tcp or udp
}