DNS Exfiltration via Ping/Dig/Nslookup Command with Data-Encoded Subdomain Label
An attacker tricks an AI coding assistant into running a normal-looking network command like ping or dig, but hides a stolen password or API key inside the hostname it looks up. Because ping and dig are treated as harmless, the agent runs them without asking permission, and the secret leaves the network as a DNS query instead of an HTTP request.
How the attack works
An attacker plants a prompt injection in content the agent reads, instructing it to read a secret (such as a .env file value) and build a hostname out of it. The secret is encoded to survive as a DNS label -- typically by replacing '=' with '-' in base64, or by embedding a recognizable credential prefix directly in the hostname. The agent then runs ping, dig, or nslookup against that hostname, believing these are safe, read-only diagnostic commands. The attacker's DNS server logs the query and recovers the secret from the subdomain label, with no outbound HTTP call and no user confirmation required.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 2172d59a-5975-4f16-9621-555320b53461
- Severity
- Critical
Why it matters
Sensitive values such as API keys, tokens, or .env secrets can leave an organization's network undetected, bypassing controls that only monitor HTTP/HTTPS egress, because DNS lookups are rarely inspected or blocked to the same degree.
What you can do
- →Do not treat ping, dig, or nslookup as read-only or safe-by-default for AI agents; require confirmation before they run with attacker-influenced or externally-sourced arguments.
- →Monitor and log DNS queries, especially those with long, high-entropy, or mixed-case subdomain labels going to unfamiliar domains.
- →Restrict AI agents' ability to construct command-line arguments from untrusted content such as web pages, file contents, or third-party tool output.
- →Rotate any secrets that may have been accessible to an agent that ran network-diagnostic commands with attacker-influenced hostnames.
Known benign look-alikes
- Ordinary network troubleshooting: 'ping google.com', 'dig +short example.com', 'nslookup 8.8.8.8'
- Internal hostnames with short dash-separated segments (e.g. 'ping my-server-01.internal.corp') do not meet the 10+/4+/4+ character segment thresholds
- Ordinary long service/deployment names common in cloud infra (e.g. 'dig authentication-service-7d4b8c9d6f-abc12.prod.svc.cluster.local', 'ping development-server-workload-01.example.com') read as plain lowercase English words/short hex hashes, not a mixed-case or 16+ char hex encoded blob
- A security engineer discussing this exact DNS-exfiltration technique in an incident-response writeup, without actually issuing the command