There was some specific cyber security challenge (Cyber Cube 2018, GE). In one of the tasks, objective was to gain the access to some specific file that server included.
After successfully solving some steps, there was a base64 encoded string:
Decoding this string gave following output:
'name: eternalromance, protocol: dns(53/tcp)\n'
I figured that the only way to access the server was to perform a DNS attack.
Creators of this challenge gave a hint that choosing TCP port over UDP for DNS may cause certain vulnerabilities.
I'm not experienced in domain name systems, but I know that generally DNS uses UDP port 53 to serve requests - DNS queries require single UDP datagram request and require single UDP datagram response. Main reasons to choose TCP protocol is to respond with data that is larger than 512 bytes (although some DNS implementations can allow UDP datagram responses up to 4096 bytes by my knowledge), and for DNS zone transfers.
But what vulnerabilities may DNS have when TCP is used over UDP?