I'm learning about data exfiltration using ICMP and delivery of a payload is generally done using the -p "pad bytes" in ping -c 1 -p $encoded_payload. Are there often legitimate use for "pad bytes"? Can it simply be stripped by a firewall in most cases?

  • To add something of potential value :) Why don't you just drop ICMP ping/pong? Many firewalls seems to, and while it's annoying when trying to diagnose network issues, it's probably less surprising than changed packets.
    – domen
    Mar 2, 2022 at 11:04
  • Are there often legitimate use for "pad bytes"? - Android ping uses it to include a timestamp for computing the round-trip time. Mar 2, 2022 at 13:34
  • @domen While dropping ICMP is a great option, I'm looking into attacking & defending when certain ports & protocols are allowed, looking for ways to hide data in transit from people in the SOC & how to detect such things. Mar 2, 2022 at 14:13


You must log in to answer this question.

Browse other questions tagged .