Databouncing

databouncing is the art of indirect exfiltration using hostname lookups as a transport medium - click the link, snoop around.

[Databouncing @databouncing]

A little thread on the concern set of data-bouncing,

The most important component here is that the exfil is second order, also known as indirect, this means you can’t control it within your network, while many refer to it as a DNS exfil, that’s only the second leg, 1/*

[Databouncing @databouncing]

@mthcht2 @yeahbutnahbut 🫡🫡

[Databouncing @databouncing]

Some good insight from @DidierStevens https://t.co/yFFLXovimX could be useful to make life harder where it fails (as a benifit) in databouncing

[Databouncing @databouncing]

Approved 🫡

[vs1m @Vsimpro]

Been building on this idea https://t.co/9g4UmKZZeS
Using signup forms for databounce/data exfil

Got the POC working: Playwright automation to register emails, triggers DNS lookups -> my listener catches + send the file to a Discord webhook.

data-exfil using facebook reg :D!

[Databouncing @databouncing]

Hmmm Databouncing + Fastflux, hmmmm

[Databouncing @databouncing]

@elonmusk Too huh ? 😂

[Databouncing @databouncing]

If you want to databounce via email https://t.co/LG9GjiqjxZ

This is crude but functional

It will use the hostname space as you’d expect, 500 recipients per send

[Databouncing @databouncing]

@SwiftOnSecurity Ubi looks great but, looks locked in, synology has a good balance of flexibility and integration (just doesnt have that slick ubi UX)

[Databouncing @databouncing]

we feel that the only reason Databouncing hasn’t gotten the attention it deserves is because the PoCs have mostly been fun demonstrations of its capability - if you could share for reach 🙌❤️ 4/4

[Databouncing @databouncing]

A little bit of positive downtime, and we’re back at it

We’re looking for some assistance in building databouncing integration into C2 frameworks (Sliver, Tuoni, Merlin, others ?)
1/4

[Databouncing @databouncing]

I’d be happy putting a reward out for whoever authors something stable first, you’d get support from myself @DeathsPirate and @N1ckDunn where we have time 3/4

[Databouncing @databouncing]

https://t.co/G8cHyDMzzc great for businesses, and databouncing aficionados ?

[Databouncing @databouncing]

While databouncing is pretty unstoppable in most cases it’s always nice if you’re gifted even more:

PAN-234015
The X-Forwarded-For (XFF) value is not displayed in traffic logs.

[Databouncing @databouncing]

@DeathsPirate @PamKeithFL Narrowcasting is the term, and it’s made things very ugly 🫠

[Databouncing @databouncing]

@HackingDave Oh my

[🏴‍☠️ ÐΞΛТHS PłЯΛТΞ @DeathsPirate]

I'll be speaking at Defcon Gloucester this evening on all things @databouncing. Hopefully see some of you later!

[Databouncing @databouncing]

Seeing lots of databouncing candidates on Chinese infrastructure 🥸

[Databouncing @databouncing]

Ayo #bugbounty hunters, you want to squeeze some money out of those lame host header poisonings ? Check out CWE-441 - then check out #databouncing - all you have to do is argue with triage until you are a millionaire 😁🫡

[Databouncing @databouncing]

@teamcymru_S2 do you fancy a run at countermeasures ?

[Databouncing @databouncing]

without actually putting any data on any services of those domains, this is industrialized exfiltration and no one seems to have an answer.

[Databouncing @databouncing]

@Microsoft asked us to refer to @Akamai when we demo'd Databouncing through their domains, Akamai's guy said essentially 'that's how the internet works', what's interesting is that when we spoke to NSA it was suggested that @Cloudflare had a response

[Databouncing @databouncing]

There are some very real implications to this technique and the reason we put time and money into building https://t.co/TWWq4yPk8c was to force the conversation not being had. - we'll start chipping away visually demonstrating how to move files via trusted domains...