Data leaving in DNS questions
One laptop keeps asking for long random-looking TXT names under the same domain. Find the client and the domain, then decode the labels to see what was sent.
Briefing
The resolver on the finance VLAN logs every question to /var/log/dnsmasq.log. A threat feed flagged cdn-sync.example as new and unranked.
DNS tunnels hide data in the leftmost label of each query. Each label is short, so the tool sends many queries in a row. Hex or base32 labels are common because DNS names only allow letters, digits, and hyphens.
resolver-fin · DNS investigation
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.