Sunburst
Bizarre and unusual uses of DNS
Rule 53: If you can think of it, someone's done it in the DNS
Peter Lowe
Principal Security Researcher | DNSFilter
whoami
Potential Titles
What
DNS in 2 minutes
Why
Not my fault
Caveats
And notes
Traceroutes
OK, so maybe not 100% DNS…
Traceroutes
Star Wars
From Ryan Werber at beagle.net in Feb 11th 2013
Down because of DDoS
IPv6 versions popped up
Gone but not forgotten
Traceroutes
hand.bb0.nl
Interesting extension using IPv6 - apparently there's more if you increase hops
Traceroutes
Euro 2020
Sebastian Haas' "fakert" that creates a TUN device
IP range routed to where the fakert is running
@_sehaas on Twitter
Traceroutes
makerforce.io
By Ambrose Chua
To the tune of "American Pie"
Traceroutes
bad.horse
Traceroutes
bad.horse
From Dr Horrible's Sing-Along
Bonus: cert chain from signed.bad.horse
Traceroutes
Christmas
Ho
Ho
Ho
Tools and Toys
Tools and Toys
Calculator
Sadly not around anymore
There's a reverse Polish calculator out there as well
Tools and Toys
"My IP"
OpenDNS
Tools and Toys
"My IP"
Tools and Toys
IP to ASN
From Team Cymru - similar to Whois but faster
Tools and Toys
Postcodes
Tools and Toys
dns.toys
From Kailash Nadh, CTO of Zerodha
Tools and Toys
Geocaching
From Sebastian Haas:�
Mockapetris himself wasn't involved in the geocache. "Mockapetris_1876" is just a hint to DNS and RFC 1876 ;)
The cache is maintained by me.
To solve the complete riddle you have to execute multiple queries (TXT, AAAA, PTR, LOC). You can find the solution in the screenshot.
Tools and Toys
Text adventure
By Craig Mayhew, @craigmayhew
Uses round robin DNS for chance-based actions
Tools and Toys
Drink
From Stéphane Bortzmeyer, @bortzmeyer
Amazing general purpose dynamic DNS server
Try 2+2.op.dyn.bortzmeyer.fr, LOC and URI query types on random.dyn.bortzmeyer.fr
Tunneling
Tunneling
General idea
https://www.daemon.be/maarten/dnstunnel.html
Discussed on Slashdot back in 2000
Any record types
Tunneling
Wikipedia
David Leadbetter
Tunneling
Blogging
Add TXT records to "publish" a post
By Harshad Sharm - trying to "break coder's block"
Tunneling
IP over DNS
Erik Eckman - @yarrick on GitHub
IPv4 only inside the tunnel, but server can listen on IPv6
Iodine has the atomic number 53
Tunneling
HTTP over DNS
Jessie Li, @veggiedefender on GitHub
HTTP over DNS over HTTPS?
Tunneling
VPN over DNS
"Contains ads"
Tunneling
dnscat2
Iagox86 on GitHub, or "Ron"
Doesn't need a domain
Looks exactly like normal DNS traffic
And more
Bigger things
DNS for config
Corey Quinn
Using Route 53 for config management
@quinnypig on Twitter
Bigger things
Brands
Bigger things
Contacts DB
"Free, unlimited, unrestricted access to data about every company in the UK*"
npm modules, developer docs
Numprotocol.com
NUM technology
Bigger things
Key-value store
Generic service offered to allow people to set and retrieve values
Not sure who's behind this!
Bigger things
DNSFS
Ben Cox, benjojo.co.uk
Bigger things
MP3s
One use of DNSFS…
Links
https://dnsfilter.com/ - DNSFilter
https://github.com/sehaas/fakert - Sebastian Haas' fakert
https://beaglenetworks.net/post/42707829171/star-wars-traceroute - Star Wars traceroute
https://dgl.cx/wikipedia-dns - Wikipedia over DNS
https://www.youtube.com/watch?v=_y36fG2Oba0 - The Day The Router Died
https://www.youtube.com/watch?v=O03k0DV2m1k - Bad Horse
https://asciinema.org/a/15020 - Christmas traceroute
https://team-cymru.com/community-services/ip-asn-mapping/#dns - IP to ASN mapping
https://www.cambus.net/interesting-dns-hacks/ - few things including the calculator, My IP
https://jpmens.net/2020/10/04/airports-of-the-world/ - Airports
https://github.com/gryphius/ch-loc - Oli Schacher's Swiss location stuff
https://www.daemon.be/maarten/dnstunnel.html - Discussion of DNS tunneling
https://coord.info/GC615NM - Geocache
https://github.com/craigmayhew/dns-adventure-game - text adventure over DNS
https://github.com/hiway/txtrex - blogging via DNS (Harshad Sharma - @hiway)
https://gist.github.com/Manawyrm/718cf8ab6ba59ba95d9743d01b1763dd - MP3 streaming
https://github.com/yarrick/iodine - iodine - IP over DNS
https://github.com/veggiedefender/browsertunnel - HTTP over DNS
https://www.lastweekinaws.com/podcast/aws-morning-brief/whiteboard-confessional-route-53-db/ - DNS for config management
https://play.google.com/store/apps/details?id=com.in.troiddns - SlowDNS - VPN over DNS
https://dnskv.com/ - DNS Key Value Storage
https://github.com/iagox86/dnscat2 - dnscat2
https://bimi.agari.com/ - Brand Indicator Records
https://tools.ietf.org/id/draft-blank-ietf-bimi-00.html - BIMI draft
https://www.num.uk/ - num.uk business
https://www.numprotocol.com/ - the NUM protocol
https://github.com/benjojo/dnsfs - DNSFS
https://team-cymru.com/community-services/ip-asn-mapping/#dns - IP to ASN mapping
https://www.bortzmeyer.org/drink.html - Drink DNS server
https://github.com/pgl/rule53 - Rule53 list on GitHub
https://twitter.com/pgl/status/1405614755000295427 - Twitter thread
Questions?
Principal Museum of DNS Curator Security Researcher @ DNSFilter
Open for work
twitter.com/pgl�infosec.exchange/@pgl