This week had a lot packed in. The QTerminal path thing and the bash read -e / $HOME issue are basically the same lesson twice, when a fix doesn't stick after a few tries it's probably not the bug you think it is, worth just going and checking the actual paths and config instead of guessing again.
Small thing on the DNS tunneling bit though: most tools that do this, dnscat2 included, actually default to UDP 53, not TCP. UDP is what normal DNS traffic looks like so it blends in, whereas TCP 53 is rare enough (mostly zone transfers, oversized responses) that a sustained TCP session would stick out in logs, which is kind of the opposite of what you want if you're trying to hide. That actually lines up with what you said earlier, that TCP 53 on a scan is worth a second look. Attackers only really go TCP when they need bigger payloads or a stable session and are okay trading stealth for that. DNS logging being the blind spot is spot on though, that part's real.
This week had a lot packed in. The QTerminal path thing and the bash read -e / $HOME issue are basically the same lesson twice, when a fix doesn't stick after a few tries it's probably not the bug you think it is, worth just going and checking the actual paths and config instead of guessing again.
Small thing on the DNS tunneling bit though: most tools that do this, dnscat2 included, actually default to UDP 53, not TCP. UDP is what normal DNS traffic looks like so it blends in, whereas TCP 53 is rare enough (mostly zone transfers, oversized responses) that a sustained TCP session would stick out in logs, which is kind of the opposite of what you want if you're trying to hide. That actually lines up with what you said earlier, that TCP 53 on a scan is worth a second look. Attackers only really go TCP when they need bigger payloads or a stable session and are okay trading stealth for that. DNS logging being the blind spot is spot on though, that part's real.