🛰️ DNS Keylogger

A proof-of-concept keylogger that demonstrates DNS-based data exfiltration by encoding keystrokes into Base32 and transmitting them through DNS subdomains to a custom DNS server.

⚠️ Disclaimer: This project was created strictly for educational and research purpose. It demonstrates how data exfiltration can occur using DNS queries. Do not deploy or use this software on systems without explicit permission. Unauthorized monitoring of user input may be illegal in many jusdictions.

If you found this project interesting, consider ⭐ starring the repository.

🎬 Demo

📖 Overview

This project demonstrates a proof-of-concept keylogger that exfiltrates captured keystrokes through DNS queries

Instead of sending data via traditional HTTP requests or sockets, the captured keystrokes are:

1. Collected locally by a Python keylogging script > logger.py
2. Encoded using Base32
3. Sent as part of DNS subdomain queries
4. Received by a custom DNS server using dnslib > server.py
5. Decoded and stored in a text file

The goal of this project is to demonstrate how covert data exfiltration channels can be implemented using DNS, which is often allowed through firewalls and security controls.

⚙️ Architecture

┌───────────────┐
│ Victim Host   │
│               │
│   Keylogger   │
│               │
└───────┬───────┘
        │ 
        │ 
    DNS Query 
        ▼  
encoded-data.domain.com
        │ 
        ▼ 
┌────────────────────┐ 
│ Custom DNS Server  │ 
│                    │ 
│ • Extract label    │ 
│ • Base32 decode    │ 
│ • Save keystrokes  │ 
└─────────┬──────────┘ 
          │ 
          ▼ 
      logs.txt

📂 Project Structure

dns-keylogger/
│ 
├── logger.py 
├── server.py 
├── logs.txt │ 
├── assets/ 
    │ 
    └── demo.gif 
│ 
└── README.md

🔐 Why Base32?

DNS labels have strict character limitations.

Allowed characters:

• a-z
• 0-9

Base32 ensures the encoded data remains DNS-safe.

Example: hello -> NBSWY3DP

⭐ Possible Features to Add

• Data Chunking | split long messages into multiple DNS queries
• Encryption | encrypt keystrokes before encoding
• Session Tracking | track multiple clients
• Packet Camouflage | mix real DNS lookups with exfiltration traffic.