I'm learning about data exfiltration using ICMP and delivery of a payload is generally done using the -p "pad bytes" in ping -c 1 -p $encoded_payload. Are there often legitimate use for "pad bytes"? Can it simply be stripped by a firewall in most cases?
asked Mar 2, 2022 at 10:45
-
To add something of potential value :) Why don't you just drop ICMP ping/pong? Many firewalls seems to, and while it's annoying when trying to diagnose network issues, it's probably less surprising than changed packets.– domenMar 2, 2022 at 11:04
-
Are there often legitimate use for "pad bytes"? - Android ping uses it to include a timestamp for computing the round-trip time.– Steffen UllrichMar 2, 2022 at 13:34
-
@domen While dropping ICMP is a great option, I'm looking into attacking & defending when certain ports & protocols are allowed, looking for ways to hide data in transit from people in the SOC & how to detect such things.– ChocolateOverflowMar 2, 2022 at 14:13
Add a comment
|