I suppose it is, because the DNS has to be resolved whereas reverse_tcp uses an IP address.

I would like to know all the differences between them, because although I like reverse_tcp_dns, I would still opt for reverse_tcp if it's better.


Yes your correct. reverse_tcp_dns is slower than reverse_tcp to establish the connection. The only differences between these two payloads are the reverse_tcp_dns takes extra time to connect back due to the domain name resolution and the reverse_tcp_dns payload is approximately 70 bytes bigger than reverse_tcp payload.


Metasploit's reverse_tcp_dns payload doesn't resolve DNS queries to connect back to the attacker, unless you've provided it an FQDN as the LHOST value (You can also provide an IP address as LHOST).

Instead, it uses DNS queries as a mode of communication between the victim machine and the attacker machine. The commands you enter in meterpreter are sent to the victim machine disguised inside DNS records, and the responses are sent back to your machine disguised as DNS queries.

In summary, the data exchange takes place over TCP in reverse_tcp, and it takes place over DNS+TCP in reverse_tcp_dns. So, yeah, there is a significant overhead in transmitting the data inside DNS packets (which in turn will be made into TCP packets) instead of transmitting them over TCP packets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.