Dealing with DNS Filters
When confronting a DNS filter, our goal is to select a domain that appears
legitimate, is likely allowed by the target’s policy, and is not blocked.
We’ll address each of these requirements in this section
and suggest methods for meeting them.
It may be seem logical to register a new domain,
but it may be categorized as a Newly Seen Domain.
This can be equally detrimental to the reputation score,
since penetration testers and malware authors often use brand new domains.
Domains in this category are often less than one week old
and are relatively unused, lacking inquiries and traffic.
Because of this, we should collect domain names in advance
and generate lookups and traffic well in advance of an engagement.
However, even if our domain is classified as clean,
we need to make sure its domain category matches what the client allows.
For example, the “webmail” classification is often disallowed
given the increased risk of downloaded malware.
In most cases, we should pre-populate a web site on our domain
with seemingly harmless content, like a cooking blog,
to earn a harmless category classification.
We can even go so far as to subscribe to domain categorization services
so we can submit our own domain classifications.
Even if our domain has been categorized as malicious, we can easily host a
legitimate-looking website on the domain and request re-categorization.
To demonstrate, we can submit a vote request for an OpenDNS tag
for the parcelsapp.com domain, which is a popular parcel tracking website.
We could also vote on other user’s submissions as well.
We can also submit the domain for a community review
if voting is not available or if we would like to suggest a different category.
In addition to guarding and monitoring our domain’s reputation,
we should take steps to make the domain name itself appear legitimate.
For example, a domain name consisting of legitimate-sounding text
is less suspicious than a domain consisting of random numbers
and characters, especially when examined by natural language.
processing filtering systems.
One technique popularized by malware authors and penetration testers
is known as typosquatting, which leverages subtle changes
in recognizable domain names.
For example, if our target uses example.com,
we could register a visually similar domain
by replacing the letter “l” with the number 1.
Although this technique could entice a user to click a phishing link,
some services can filter and issue alerts regarding typo-squatted domains.
Finally, we must be aware of the status of the IP address of our C2 server.
If the IP itself has been flagged as malicious,
some defensive solutions may block the traffic.
This is especially common on shared hosting sites
in which one IP address hosts multiple websites.
If one site on the shared host ever contained a browser exploit
or was ever used in a watering hole malware campaign,
the shared host may be flagged.
Subsequently, every host that shares that IP may be flagged as well,
and our C2 traffic may be blocked.
To guard against this, we should use a variety of lookup tools,
like the previously-mentioned Virustotal and IPVoid sites
to check the status of our C2 IP address before an engagement.
To recap, when faced with a DNS filter, we should begin preparation
well in advance and do our best to make the domain seem as legitimate as possible.
We should ensure that our domains are in a likely-permissible category
and we should have several domains prepared in advance
so we can swap them out as needed during an engagement.
Now that we’ve examined DNS filter bypasses, we’ll move on to the most
common filtering device: the web proxy server.