Showing posts with label iodine. Show all posts
Showing posts with label iodine. Show all posts

Sunday, January 25, 2015

DNS reverse proxy

I have a server with a single IPv4 and I want to run two DNS servers:
  • one to serve zones like stalkr.net - if you recall, I like PowerDNS;
  • another one for tunneling - I like dns2tcp (TCP level), another good one is iodine (IP level).
Problem: I looked a bit but none of the DNS server software I've seen support forwarding queries that aren't for them to another server. Basically what I need is a reverse proxy that looks at the DNS query, and route it based on the name. It's the same as an HTTP reverse proxy that looks at the Host field to proxy the request to another server. I tried to hack with resolvers and stub/forward zones but it didn't work.

So I made my own dns-reverse-proxy in just a few lines of Go, using a fully featured DNS library. It's running smoothly, if you have the same need feel free to use it!

Sunday, October 31, 2010

Hack.lu CTF - Challenge 9 "bottle" writeup, extracting data from an iodine DNS tunnel

Challenge #9 entitled "bottle" was original and worth its 500 points. We were given the following network capture and instructed to find a message.

Opening the capture in Wireshark reveals a lot of DNS traffic (and 4 ARP requests): it definitely looks like a DNS tunnel.