ENSI CTF — TSKHINAT Forensics Challenge Writeup

By : 0xblu3

Category: Network Forensics

Techniques: DNS Exfiltration, Hex Decoding, Packet Analysis

What is DNS Exfiltration?

Before diving into the challenge, it’s worth understanding the attack we’re dealing with.

DNS (Domain Name System) was designed in 1983 with one job: translate domain names like google.com into IP addresses. Security was never part of the original design, and that gap is exactly what attackers exploit.

The core idea is simple: instead of sending stolen data over HTTP or FTP — which firewalls watch closely — an attacker encodes the data inside DNS query names and sends it out one lookup at a time. Since DNS port 53 is almost never blocked (block it and nothing works), the data slips right through.

Step 1 — Open the capture in Wireshark

Load the .pcap file in Wireshark and apply a display filter to isolate traffic for the suspicious domain:

dns.qry.name contains "cyberspace.ma"

You’ll immediately notice something unusual: dozens of DNS queries for hex-looking subdomains like 43.cyberspace.ma, 53.cyberspace.ma, 7b.cyberspace.ma — all returning No such name. This is the fingerprint of DNS exfiltration. The subdomains aren't real hostnames, they're data being smuggled out one byte at a time.

Step 2 — Extract the subdomains with tshark

First we dump all query names filtering out responses to avoid duplicates:

tshark -r capture.pcap \
  -Y "dns.flags.response==0 && dns.qry.name contains \"cyberspace\"" \
  -T fields -e dns.qry.name

Then strip everything except the subdomain label:

tshark -r capture.pcap \
  -Y "dns.flags.response==0 && dns.qry.name contains \"cyberspace\"" \
  -T fields -e dns.qry.name \
  | awk -F'.' '{print $1}'

43
53
50
7b
...

Save this output to a file called hexencoded.

Step 3 — Decode the hex

Each subdomain is a single hex-encoded byte. Join them and decode using this python script :

hexfile = open('hexencoded').read().split()
print(bytes.fromhex(''.join(hexfile)).decode())

Run the script :

FLAG : CSP{W4_XB4R_XB4R_D1K_D4TA}

How To Detect DNS EXFILTRATION:

Defenders look for these patterns in network traffic:

• High query volume to a single domain in a short window
• NXDOMAIN flood — many queries that all return “No such name”
• Hex or base64-looking subdomains — 43., aGVs., 7b. instead of real words
• Unusual subdomain length — legitimate services rarely use 30+ character subdomains
• Single internal host making all queries — one machine hammering DNS repeatedly

Tools like Zeek, Suricata, and Splunk can be tuned to alert on all of these patterns. In Wireshark, a simple filter like dns.qry.name contains "suspicious-domain.com" makes the pattern immediately visible — which is exactly how we solved this challenge.