I suppose it is, because the DNS has to be resolved whereas reverse_tcp uses an IP address.
I would like to know all the differences between them, because although I like reverse_tcp_dns, I would still opt for reverse_tcp if it's better.
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
Yes your correct. reverse_tcp_dns is slower than reverse_tcp to establish the connection. The only differences between these two payloads are the reverse_tcp_dns takes extra time to connect back due to the domain name resolution and the reverse_tcp_dns payload is approximately 70 bytes bigger than reverse_tcp payload.
reverse_tcp_dns payload doesn't resolve DNS queries to connect back to the attacker, unless you've provided it an FQDN as the LHOST value (You can also provide an IP address as LHOST).
Instead, it uses DNS queries as a mode of communication between the victim machine and the attacker machine. The commands you enter in
meterpreter are sent to the victim machine disguised inside DNS records, and the responses are sent back to your machine disguised as DNS queries.
In summary, the data exchange takes place over TCP in
reverse_tcp, and it takes place over DNS+TCP in
reverse_tcp_dns. So, yeah, there is a significant overhead in transmitting the data inside DNS packets (which in turn will be made into TCP packets) instead of transmitting them over TCP packets.