Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Detect DNS Tunneling
Mission
Analyze the DNS query log `dns_queries.log` to detect data exfiltration via DNS tunneling. Find the host flooding a single domain with long-label queries, order the labels by seq, and hex-decode them to recover the flag.
Hints
Hint 1 Show
Aggregate dns_queries.log by (source IP, base domain) and find the pair with an outlier query count
Hint 2 Show
Only one internal host floods a single domain (exfil.badcorp-c2.example) with long-label queries
Hint 3 Show
Order that domain's leading seq labels, concatenate the next label of each, and hex-decode to get the flag