A little thread on the concern set of data-bouncing,
The most important component here is that the exfil is second order, also known as indirect, this means you can’t control it within your network, while many refer to it as a DNS exfil, that’s only the second leg, 1/*
Been building on this idea https://t.co/9g4UmKZZeS
Using signup forms for databounce/data exfil
Got the POC working: Playwright automation to register emails, triggers DNS lookups -> my listener catches + send the file to a Discord webhook.
data-exfil using facebook reg :D!
If you want to databounce via email https://t.co/LG9GjiqjxZ
This is crude but functional
It will use the hostname space as you’d expect, 500 recipients per send
we feel that the only reason Databouncing hasn’t gotten the attention it deserves is because the PoCs have mostly been fun demonstrations of its capability - if you could share for reach 🙌❤️ 4/4
A little bit of positive downtime, and we’re back at it
We’re looking for some assistance in building databouncing integration into C2 frameworks (Sliver, Tuoni, Merlin, others ?)
1/4
I’d be happy putting a reward out for whoever authors something stable first, you’d get support from myself @DeathsPirate and @N1ckDunn where we have time 3/4
While databouncing is pretty unstoppable in most cases it’s always nice if you’re gifted even more:
PAN-234015
The X-Forwarded-For (XFF) value is not displayed in traffic logs.
Ayo #bugbounty hunters, you want to squeeze some money out of those lame host header poisonings ? Check out CWE-441 - then check out #databouncing - all you have to do is argue with triage until you are a millionaire 😁🫡
@Microsoft asked us to refer to @Akamai when we demo'd Databouncing through their domains, Akamai's guy said essentially 'that's how the internet works', what's interesting is that when we spoke to NSA it was suggested that @Cloudflare had a response
There are some very real implications to this technique and the reason we put time and money into building https://t.co/TWWq4yPk8c was to force the conversation not being had. - we'll start chipping away visually demonstrating how to move files via trusted domains...