EARWIG - EARWIG is an Advanced DNS Exfiltration Research To

项目说明

EARWIG - Ad DNS Exfiltration Tool

<p align="center">

<img src="

<img src="

<img src="

<img src="

<img src="

<br>

<img src="

<img src="

<img src="

<img src="

!EARWIG

!Security

!Network

!Status

!Build

</p>

⚠️ LEGAL DISCLAIMER

WARNING: This tool is designed for legitimate security testing, penetration testing, and educational purposes only. Users must ha written authorization from the system owner before using this tool. Unauthorized use of this tool may laws and regulations. The de assume no liability for any misuse or damage caused by this tool. USE RESPONSIBLY AND ETHICALLY.

---

📋 O

EARWIG is a sophisticated gray hat hacking tool that enables covert data transfer through DNS (Domain Name System) requests. By le the fundamental DNS protocol, EARWIG can exfiltrate files from compromised networks without detection by traditional security monitoring tools, making it an essential component of any penetration tester's arsenal.

🎯 Primary Purpose

EARWIG serves as a DNS tunneling and data exfiltration framework designed to:

· Bypass network security controls (firewalls, IDS/IPS)
· Evade data loss pre (DLP) systems
· Transfer files from restricted networks
· Establish covert communication channels
· Test DNS security configurations

---

🔥 Key Features

Core Capabilities

· DNS Protocol Exploitation: Transmits data DNS queries to avoid detection
· Ad Encryption: RC4 stream cipher for data protection
· Multiple Encoding Formats: Supports Base64URL, Base32, and Base64
· Data Compression: Optional zlib compression to reduce transfer size
· Chunked Transfers: Splits large files into manageable DNS query-sized pieces
· Real-time Progress Tracking: feedback during transfers
· Multi-threaded Server: Concurrent processing of multiple clients
· Persistent State Management: Resume interrupted transfers
· Automatic Retry: Built-in retry mechanism with exponential backoff
· Legacy Mode: Backward compatibility with older EARWIG

(root is required for using this tool)

Technical Specifications

Feature Details
Protocol DNS (UDP/53)
Max File Size 100 MB
Chunk Size 57-63 bytes (configurable)
Encoding Base64URL / Base32
Encryption RC4 Stream Cipher
Compression zlib (optional)
Concurrent Clients Up to 10 (configurable)
Timeout Handling Configurable (default: 60s)

---

💻 Installation & Requirements

Prerequisites

Quick Installation

---

🚀 Usage Guide

Server Mode (Receiving Files)

Client Mode (Sending Files)

---

🔍 How It Works

Data Flow Architecture

Step-by-Step Process

1. File Preparation: The file is read and metadata (name, timestamps, permissions) is extracted
2. Compression: Optional zlib compression reduces data size
3. Encryption: RC4 encryption with user-provided password
4. Encoding: Data is encoded as Base64URL or Base32
5. Chunking: Encoded data is split into DNS-safe chunks (≤63 bytes)
6. Transmission: Each chunk is sent as a DNS query to the specified server
7. Reception: Ser queries and reassembles chunks
8. Decoding: Data is decoded from Base64/Base32
9. Decryption: RC4 decryption with the same password
10. Decompression: Optional zlib decompression
11. File Reconstruction: Original file is reconstructed with metadata

---

🛡️ Security & E Features

E Techniques

· DNS Protocol Mimicry: All traffic appears as legitimate DNS queries
· Fragmented Transfers: Data is split across multiple DNS requests
· Encoding: Multiple encoding formats supported
· Optional Encryption: RC4 stream cipher for payload protection
· No Persistent Connections: Uses UDP, no connection state to track
· Standard Port: Uses port 53, typically allowed through firewalls

Detection A

· Low footprint on target system
· No additional binaries required (nati)
· Clean logs and minimal system impact
· Can operate through proxy and

---

🎯 Use Cases

Ethical Hacking Scenarios

1. Penetration Testing: Transfer test files from compromised systems
2. Security Audits: Test DNS security configurations
3. Data Recovery: Retrie from restricted networks
4. Red Team Operations: Covert data exfiltration during exercises
5. Compliance Testing: DLP and monitoring systems

Gray Hat Applications

· Security Research: Understanding DNS tunneling techniques
· Education: Teaching about covert channels
· Legitimate Exfiltration: Reco legitimate data from inaccessible systems

---

🔬 Technical Deep Dive

Protocol Structure

Chunk Structure

Encryption Details

· Algorithm: RC4 stream cipher
· Key Length: (user-provided)
· Mode: Synchronous (same key for encryption/decryption)
· Implementation: Byte-by-byte XOR operation

---

📊 Performance Metrics

File Size Chunk Size Chunks Transfer Time
1 MB 57 bytes 18,400 ~2 minutes
10 MB 60 bytes 175,000 ~20 minutes
50 MB 63 bytes 833,333 ~90 minutes

Times approximate based on 100ms per DNS query

---

<p align="center">
<img src="assets/2.png" alt="Banner 2" width="100%">
</p>

🛠️ Ad Configuration

Ser

Client Optimization

---

🔒 Security Considerations

Best Practices

1. Use Strong Passwords: At least 16 characters with mixed case
2. Enable Compression: Reduces transfer time and footprint
3. Limit Concurrent Transfers: Avoid o the server
4. Monitor Logs: Regular review of transfer logs
5. Clean Up: Remo files after use
6. Use Encryption: Always encrypt sensitive data
7. Integrity: Check MD5 checksums of recei

Risk Mitigation

· Detection Risk: Use during off-peak hours
· Blocking Risk: Vary domains and IP addresses
· Forensic E: Clean logs and remo
· Legal Risk: Ensure proper authorization before use

---

🐛 Troubleshooting

Common Issues

Issue Solution
Connection refused Check DNS server IP and firewall rules
Timeout errors Increase timeout or check network
Decryption failed password is correct
Incomplete chunks Ensure DNS responses are received
Port 53 in use Stop other DNS services (systemd-resolved)
Permission denied Run with sudo or set capabilities

Debugging

---

🤝 Ethical Guidelines

Acceptable Use

· Written authorization from system owner
· Legitimate security testing purposes
· Educational and research acti
· Security audits and compliance testing

Unacceptable Use

· Unauthorized data access or transfer
· Malicious exfiltration of sensitive data
· Testing without proper authorization
· Any activity applicable laws

Professional Conduct

1. Always obtain written permission
2. Document all acti
3. Maintain confidentiality
4. Report findings responsibly
5. Clean up after testing
6. Follow organizational guidelines

---

📚 Additional Resources

Related Concepts

· DNS Tunneling
· Data Exfiltration Techniques
· Covert Channels
· RC4 Cryptography
· Base64 Encoding

Security Frameworks

· MITRE ATT&CK Framework
· OWASP Testing Guide
· NIST Cybersecurity Framework
· PTES (Penetration Testing Execution Standard)

---

📞 Contact & Support

· GitHub: github.com/sylhetyhack/earwig
· Issues: Report bugs Issues

---

⚖️ License

This project is licensed under the MIT License - see the LICENSE file for details.

---

Remember: With great power comes great responsibility. Use this tool ethically and legally to impro, not to exploit it. 🛡️

---

"Security is not a product, but a process." - Bruce Schneier

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕EARWIG is an Advanced DNS Exfiltration Research Tool designed for cybersecurity professionals to analyze covert DNS communication channels, study data transfer techniques, and improve network defense strategies. Built for ethical security research, penetration testing labs, and defensive analysis of DNS-based threats in controlled environments.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。