Data-Bouncing: The art of indirect exfiltration.

The post on thecontractor.io discusses a technique called “data-bouncing,” which is a method of exfiltrating data from a network by using an intermediary system to bounce the data to a final destination. Small chunks of data go into hostnames in headers such as Host, X-Forwarded-For or Referer, and trusted web servers that process those headers resolve the hostnames, delivering each chunk to a DNS server the attacker controls. The goal is to avoid detection by network defenders, who are trying to identify the source and destination of the data. Nick Dunn’s proof of concept turns the idea into a set of scripts: Recruiter and Dentist find usable hosts, Bouncer encrypts a file and sends it out in chunks, and Therapist reassembles it from the interactsh output. Host header injection, the finding usually dismissed as having no demonstrable impact, just got a job.