Clark is a professional hacker. He created and configured multiple domains pointing to the same host to switch quickly between the domains and avoid detection. Identify the behavior of the adversary in the above scenario.

Option 1 : Use of DNS tunneling

Option 2 : Unspecified proxy activities

Option 3 : Use of command-line interface

Option 4 : Data staging

1. Use of DNS tunneling

DNS tunneling enables these cyber criminals to insert malware or pass stolen information into DNS queries, creating a covert channel that bypasses most firewalls. While there are quasi-legitimate uses of DNS tunneling, domains many instances of tunneling are malicious.
Domain name system, or DNS, is that the protocol that translates human-friendly URLs, like paloaltonetworks.com, into machine-friendly IP addresses, like 199.167.52.137. Cybercriminals know that DNS is widely used and trusted. Furthermore, because DNS isn’t intended for data transfer, many organizations don’t monitor their DNS traffic in domains for malicious activity. As a result, variety of sorts of DNS-based attacks are often effective if launched against company networks. DNS tunneling is one such attack.

How DNS Tunneling Works

DNS tunneling exploits the DNS protocol to tunnel malware and other data through a client-server model.

The attacker registers a website , like badsite.com. The domains name server points to the attacker’s server, where a tunneling malware program is installed.
The attacker infects a computer, which frequently sits behind a company’s firewall, with malware. Because DNS requests are always allowed to maneuver in and out of the firewall, the infected computer is allowed to send a question to the DNS resolver. The DNS resolver may be a server that relays requests for IP addresses to root and top-level domains servers.
The DNS resolver routes the query to the attacker’s command-and-control server, where the tunneling program is installed. A connection is now established between the victim and therefore the attacker through the DNS resolver. This tunnel are often wont to exfiltrate data or for other malicious purposes. Because there’s no direct connection between the attacker and victim, it’s harder to trace the attacker’s computer.

2. Unspecified proxy activities

A proxy server acts as a gateway between you and therefore the internet. It’s an intermediary server separating end users from the websites they browse. Proxy servers provide varying levels of functionality, security, and privacy counting on your use case, needs, or company policy.
If you’re employing a proxy server, internet traffic flows through the proxy server on its thanks to the address you requested. A proxy server is essentially a computer on the web with its own IP address that your computer knows. once you send an internet request, your request goes to the proxy server first. The proxy server then makes your web request on your behalf, collects the response from the online server, and forwards you the online page data so you’ll see the page in your browser.

3. Use of command-line interface

The instruction interface could also be a program on your computer that allows you to form and delete files, run programs, and navigate through folders and files. On a Mac, it’s called Terminal, and on Windows, it’s prompt . The instruction interface may be a program on your computer that permits you to make and delete files, run programs, and navigate through folders and files. On a Mac, it’s called Terminal, and on Windows, it’s prompt .
Most developers navigate their computers and run the programs they build directly from the instruction . employing a few typed words, you’ll run a program you wrote, move through your computer’s filing system , and even edit existing files. The instruction may be a powerful application and can unlock new avenues in your programming ability.

This article will walk you thru the way to find and start using the instruction on your own machine.

4. Data staging

Staging could also be a transient area where the most recent data is kept for processing, as soon because the info is processed on subsequent batch or stream, on subsequent extraction Staging layer is refreshed.
Usually the replication methods within the ODS layers consists of three stages, staging tables for keeping delta or logical data on latency basis, history tables for all the data appending all the data from the Staging and thus the present tables which basically show the most recent data using upserts. A staging database may be a user-created PDW database that stores data temporarily while it’s loaded into the appliance. When a staging database is specified for a load, the appliance first copies the info to the staging database then copies the info from temporary tables within the staging database to permanent tables within the destination database.

Learn CEH & Think like hacker

This Blog Article is posted by

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

https://g.co/kgs/ttqPpZ

Clark is a professional hacker. He created and configured multiple domains pointing to the same host to switch quickly between the domains and avoid detection. Identify the behavior of the adversary in the above scenario.