WEBVTT

00:00:00.240 --> 00:00:10.530
Welcome to Pluralsight and this Read Team tools course featuring

00:00:10.530 --> 00:00:16.190
dnscat2, the open‑source DNS tunneling tool developed and maintained

00:00:16.190 --> 00:00:19.690
by Ron Bowes. As the Red Team operator,

00:00:19.700 --> 00:00:23.460
you may have come across scenarios in which access from the compromised

00:00:23.460 --> 00:00:27.250
systems to your C2 infrastructure becomes restricted.

00:00:27.740 --> 00:00:30.350
This is where dnscat2 comes into play,

00:00:30.840 --> 00:00:34.880
enabling you to set up a command and control channel over an

00:00:34.880 --> 00:00:39.340
encrypted DNS tunnel between a compromised machine and an

00:00:39.340 --> 00:00:42.450
authoritative DNS server that is under your control.

00:00:43.440 --> 00:00:47.490
Using dnscat2, you will be able to bypass firewalls

00:00:47.500 --> 00:00:49.950
by traversing the DNS hierarchy.

00:00:51.010 --> 00:00:54.150
The principle behind dnscat2 is quite simple.

00:00:54.540 --> 00:00:58.260
It takes advantage of legitimate use of name resolution,

00:00:58.640 --> 00:01:03.170
which is allowed outbound in order for systems to actually reach the internet.

00:01:03.940 --> 00:01:07.580
Whether you're looking to enhance your capabilities during Red Team

00:01:07.580 --> 00:01:12.170
operations or just to test your environment's defenses against complex

00:01:12.180 --> 00:01:18.370
adversarial techniques, join me as we'll set up dnscat2 on an authoritative

00:01:18.370 --> 00:01:21.950
domain to exflitrate data from a target system.