Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding case-insensitive regex #62

Merged
merged 1 commit into from
Aug 21, 2015
Merged

Adding case-insensitive regex #62

merged 1 commit into from
Aug 21, 2015

Conversation

Fox0x01
Copy link
Contributor

@Fox0x01 Fox0x01 commented Aug 21, 2015

During a test I had an issue with an DNS resolver of my target host malforming the DNS queries (uppercase/lowercase). Beause of this, the dnscat2 server was unable to establish a session. I fixed this issue by adding case-insensitive regex modifiers (/i).

During a test I had an issue with an DNS resolver of my target host malforming the DNS queries (uppercase/lowercase). Beause of this, the dnscat2 server was unable to establish a session. I fixed this issue by adding case-insensitive regex modifiers (/i).
@iagox86
Copy link
Owner

iagox86 commented Aug 21, 2015

Interesting! Was it making the domain uppercase or were you trying to use a domain with case?

I noticed that OS X mangles case in its resolver, which is why I started using all lowercase (I originally used base64). It didn't occur to me to make the regexes case insensitive, that's a good idea!

iagox86 added a commit that referenced this pull request Aug 21, 2015
Adding case-insensitive regex
@iagox86 iagox86 merged commit 55629a2 into iagox86:master Aug 21, 2015
@Fox0x01
Copy link
Contributor Author

Fox0x01 commented Aug 21, 2015

I captured the packets with tcpdump and noticed the DNS queries being a mix of upper and lower case characters. For example: Foo.ExamplE.net.
Found an article about this behavior: https://developers.google.com/speed/public-dns/docs/security?hl=en#randomize_case

It seems that this is a "security" technique to add entropy to requests by randomizing case in query names.

@iagox86
Copy link
Owner

iagox86 commented Aug 21, 2015

Thanks for the info! In addition to merging your diff, I also called out the behaviour in the docs:

d8bb539

Let me know (or send another pull request) if you want to be credited a different way :)

@Fox0x01
Copy link
Contributor Author

Fox0x01 commented Aug 21, 2015

Thank you! :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants