BeaconHunt: DNS Exfiltration Vault

Incident Summary

A corporate endpoint (10.100.5.88) was observed transmitting high-entropy, structured DNS queries to the internal recursive resolver (10.100.5.2).

Threat hunting analysts believe a remote implant is leveraging DNS tunneling to exfiltrate proprietary data in fragmented subdomains under an attacker-controlled zone.

Your Mission: Inspect the captured network traffic, isolate the DNS tunnel beaconing channel, reconstruct the sequence of exfiltrated chunks, and recover the flag.

Download Evidence (beaconhunt.pcap)

API Endpoints

• GET /health — Service health check
• GET /api/system/status — Evidence metadata, capture stats, and file integrity SHA256
• GET /download/beaconhunt.pcap — Download PCAP network capture file
• POST /api/auth/verify — Verify captured CTF flag