databouncing is the art of indirect exfiltration using hostname lookups as a transport medium - click the link, snoop around.
United Kingdom
Joined April 2024
- Tweets53
- Following19
- Followers42
- Likes77
Pinned Tweet
A little thread on the concern set of data-bouncing,
The most important component here is that the exfil is second order, also known as indirect, this means you can’t control it within your network, while many refer to it as a DNS exfil, that’s only the second leg, 1/*
Some good insight from @DidierStevens youtu.be/eh3BD7v8cZQ?si=7Thg… could be useful to make life harder where it fails (as a benifit) in databouncing
Approved 🫡
Been building on this idea databouncing.io/bouncing-wit…
Using signup forms for databounce/data exfil
Got the POC working: Playwright automation to register emails, triggers DNS lookups -> my listener catches + send the file to a Discord webhook.
data-exfil using facebook reg :D!
If you want to databounce via email gist.github.com/yosignals/dc…
This is crude but functional
It will use the hostname space as you’d expect, 500 recipients per send
A little bit of positive downtime, and we’re back at it
We’re looking for some assistance in building databouncing integration into C2 frameworks (Sliver, Tuoni, Merlin, others ?)
1/4
I’d be happy putting a reward out for whoever authors something stable first, you’d get support from myself @DeathsPirate and @N1ckDunn where we have time 3/4
While databouncing is pretty unstoppable in most cases it’s always nice if you’re gifted even more:
PAN-234015
The X-Forwarded-For (XFF) value is not displayed in traffic logs.
Databouncing retweeted
I'll be speaking at Defcon Gloucester this evening on all things @databouncing. Hopefully see some of you later!
Ayo #bugbounty hunters, you want to squeeze some money out of those lame host header poisonings ? Check out CWE-441 - then check out #databouncing - all you have to do is argue with triage until you are a millionaire 😁🫡
@Microsoft asked us to refer to @Akamai when we demo'd Databouncing through their domains, Akamai's guy said essentially 'that's how the internet works', what's interesting is that when we spoke to NSA it was suggested that @Cloudflare had a response
There are some very real implications to this technique and the reason we put time and money into building databouncing.io was to force the conversation not being had. - we'll start chipping away visually demonstrating how to move files via trusted domains...
If your defence layer is reliant on allow-lists / deny-lists of domains you trust we’ve got some bad news for you and your threat model.
Speaking of defence layers, you can obviously also move data out over trusted domains by defence providers youtu.be/8ur0X7kjOrE?si=6JEm… here’s a recruiter script validating candidates, Palo seems to be the naughtiest
Databouncing will go under the radar of traditional #CTI as we know it, I’d be interested in hearing strategies to try and bring covert comms back into the fold
Databouncing retweeted
Great day at SnoopCon. Honoured to have been accepted to talk about all things #DataBouncing and to showcase some of the behind the scenes work that some are up to.
@I_Am_Jakoby @N1ckDunn and the guys at tuoni.io