February 13, 2000

DNS Information hiding

One of the funniest ways of using DNS is by hiding information in it. DNS, as the name goes, is more about distributing Domain information. However, some people, who think differently had other ideas about it. I used the idea to hide one of my perl programs in a dns server I have access to. Execute the following line as a single command and wait for the outcome.
dig @beta.royans.net beta.royans.net axfr | grep '^host' | sort | cut -b8-39
| perl -e 'while(
){print pack("H32",$_)}' | gzip -qd

How does the real DNS look line ?
Its pretty dirty :) But have a look anyway.
dig @ns1.granitecanyon.com royans.dhs.org axfr

; <
> DiG 8.2 <
> @ns1.granitecanyon.com royans.dhs.org axfr
; (1 server found)
$ORIGIN royans.dhs.org.
@ 12H IN SOA ns1.granitecanyon.com.
rkt.pobox.com. (
153313462 ; serial
6H ; refresh
3H ; retry
1W ; expiry
12H ) ; minimum

12H IN NS ns1.granitecanyon.com.
12H IN NS ns2.granitecanyon.com.
12H IN A
12H IN RP rkt.pobox.com. @
host12.41b30512676bb8956b2a0cfcc273aae9 12H IN A
host26.64709224e45be244e57c6e5a3a0cf1d2 12H IN A
host50.1ab62f7d0cffa7c12ecfc28fdebeb4e9 12H IN A
host34.fef349259c2cf8175f7d02ed763cc06d 12H IN A
host18.9f9995ca9abe2a4384afda280a97e94b 12H IN A
localhost 12H IN A
host39.5390401b3c346be12e4bb85c4be3e1be 12H IN A
host09.215866b91460d84bc544c64054cb19d3 12H IN A
host06.e1a7a3cae8a31917478ae9d2f30ee1be 12H IN A
host13.820ad00b7ba6e44cfee96772f9ee843f 12H IN A
host36.de25f5463337214c325647c1f4f1f889 12H IN A
host15.eeaa1f9cd8027e539d15709c2489e755 12H IN A
host46.f06d0763793bf8ae83b1de1d7ce9e02d 12H IN A
host32.7fdec7f163f2046f6f4e2a97585b737a 12H IN A
host03.5bc89644724b8ac6a485b502a181d0b4 12H IN A
host48.7cb27d925b664cc04fdbfb818985de08 12H IN A
host31.6b87472e3bf2c73e69683139bf9c5e8f 12H IN A
host14.5aaa82c22bfabb9a927e927c87344642 12H IN A
host08.a52aa96560255041cbb561707f718364 12H IN A
host49.5c7f1da7152148c95b8ac0711c6c3c56 12H IN A
host37.7c98638c6c548802e3ca2441de2e4649 12H IN A
host04.0af1e31345959bb8c46a6a1bdba1ab42 12H IN A
host45.660b236b079f77309aefe09b0ec66a76 12H IN A
host23.4e6da68682ad3ed41ed50e1bd59b8df3 12H IN A
host19.ba4a6d5aa426cd43cc08de8603247c28 12H IN A
host35.53c24ea5eba2add3722c79086e5946f1 12H IN A
host43.864feec535e304ff1ef085b5013e041c 12H IN A
host21.e4ec7518325b24a8177035a579ae8741 12H IN A
host11.a6e16afc00253799cb6c1258cb5fa16d 12H IN A
host33.ea6d3a034451df28cd859d47fee7aaff 12H IN A
host44.6e39b17ed7c2f67db84662a8b7290ffe 12H IN A
host29.dc4f37380753cd80ab6341970c6a6fb9 12H IN A
host47.bd79642368471f7b07b577b0654dec00 12H IN A
host10.a6ffafe08c71f10c9a958c1a96432572 12H IN A
host17.4f31e76515a52aa32ac640637b5c3308 12H IN A
host42.b736c62ffae157370c74c42f5a366296 12H IN A
host28.49e8ce486f40265fb282658b269c9ced 12H IN A
host16.d8c798d934bda5abeb9bd326be93686b 12H IN A
host07.e006329933c075a5b9b54c003540c1b2 12H IN A
host22.cde76e83b3b151bca91d6b83e7cacdc4 12H IN A
host02.652e706c006553ef4fdb3010fd4cfe8a 12H IN A
host25.d85173f641ac37722817dc46ce897402 12H IN A
host24.9ef3b225f95c81d212af6d32c1d87712 12H IN A
host38.6d316a17149be29f8b04957e6e221228 12H IN A
host51.a4cd9ef4e1bba48bf17dfe054c0e35b9 12H IN A
host01.1f8b080897c3cf380003616e616c697a 12H IN A
host30.86c0f58f4ea6e073bc8e08075f486367 12H IN A
host40.398e2caa393e8bc7b0710849d858844f 12H IN A
host41.a4792d08cb4a67cce1cc585cb666b843 12H IN A
host27.c4a205a24e11497c0ed11c7b8c6b28b1 12H IN A
host52.d7050000 12H IN A
host05.fff79d9392d24daa62dff3bbf7eeceee 12H IN A
host20.0d04b32ba91760849438f37ebf0f9e17 12H IN A
@ 12H IN SOA ns1.granitecanyon.com.
rkt.pobox.com. (
153313462 ; serial
6H ; refresh
3H ; retry
1W ; expiry
12H ) ; minimum

;; Received 59 answers (59 records).
;; FROM: torque to SERVER:
;; WHEN: Sat Jun 10 23:03:12 2000

How to do it

There are two different source I have for it. I wrote the first one, on a cold winter day when I had nothing to do. And the other code I recieved in my mail to show me what a pathetic perl coder I am :)
My Code
A better code by Ramki(at)vtc.taos.com