1

I have been trying to detect/establish DNS tunneling. First of all I logged out of my user account of the captive portal. Findings:

$ nslookup <somesite> // works fine $ ping <somesite> // Destination Net Prohibited

Why the outputs of nslookup and ping are different. On the back they both are using ICMP protocol, I can't get that.

Moreover, since nslookup is working fine; so the DNS queries are working fine. I tried doing DNS tunneling by connecting to aVPN Server running over port 25000 using UDP. I was able to do netcat to the port and I was able to connect to the VPN while I am logged in. But when I am logged out it does not connect. So, what does it indicate ?

  • This may be relevant to your first query. – Jedi Jul 4 '16 at 14:41
  • @Jedi I on a linux system. – darxtrix Jul 4 '16 at 14:55
3

DNS does not use ICMP. It uses UDP (and rarely TCP) port 53.

The firewall/router the captive portal contols either does not block that port or it is the DNS server and is responding.

All other traffic are of course blocked until you log in.

Response to comment:

For 2), UDP has no session control, i.e. it just sends a packet without checking if it has been received or if there's even any one to receive it. So it's impossible to know if a connection worked unless you managed to receive some response from the server based on the data you send.

If you did receive response, it is possible UDP packets are entirely unblocked (which I'd consider as a poor design for a captive portal.)

For 1), ping under different systems use different mechanism. Many use ICMP Echo messages, but some attempt TCP connections or send special UDP packets to force a response. Sometimes firewall rules are not set up to block them consistently, so ping is not always trustworthy in unusual network setups.

  • I have two queries : 1) Why ping is not working ? 2) When I am logged out, I can do netcat to other servers, so basically I am sending UDP packets ? – darxtrix Jul 4 '16 at 14:38
  • 1
    For 1), it just doesn't make any sense to allow ping through when all other traffic are blocked. DNS has to be allowed to make the captive portal work. 2) what do you mean by "other servers"? Are they in the same network or are they on the Internet? What parameters you pass to nc? – billc.cn Jul 4 '16 at 14:42
  • 1) I meannslookup is working, so why not ping, do they function differently ? 2) I did netcat on an external server (internet) ``` $ nc -vz -u 176.126.237.217 25000 ``` – darxtrix Jul 4 '16 at 14:48
  • Okay, I got the ping part. – darxtrix Jul 4 '16 at 14:50
  • Thanks, great help ! So, can you suggest any other ways to bypass such systems :) , I cannot do ARP poisoning because I am under a dedicated APC(a wireless receiver of broadband signal and acts as a router, I do have logins for it admin panel though :p) and I am the single user under it. – darxtrix Jul 4 '16 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.