BERRY9 IT Services, home +91 86868 92922

Firewall Bypass and Egress Filtering

Inbound firewall rules get audited annually and tuned constantly. Egress filtering — what your hosts can reach outbound — is the one that, in practice, stops a foothold from becoming a breach. Once an attacker is inside, their command-and-control channel is on the egress path. If they cannot reach C2, the foothold is mostly inert.

Request a scoping call Call +91 86868 92922

Network · By Thimmagurudu Bathini · Published · 5 min read · Last reviewed

What we test on the way out

From a foothold inside the perimeter we attempt outbound connections on every protocol and port: DNS to arbitrary external resolvers (almost always allowed), HTTP/HTTPS to arbitrary destinations (almost always allowed), ICMP, SMB, RDP, SSH, custom ports. Each successful connection is a C2 channel for the attacker.

Common gaps

  • DNS allowed unrestricted — DNS tunneling is slow but reliable C2
  • HTTP/HTTPS allowed to any destination — proxy-less C2 over standard ports
  • Trusted SaaS allowed (Slack, Discord, Pastebin, GitHub raw, Telegram) — attackers use the same SaaS as legitimate users
  • NTP allowed outbound on UDP/123 to any host — usable for covert channels
  • Workstations allowed to talk directly to the public internet without going through a corporate proxy

What good looks like

Egress through an inspecting proxy for HTTP/HTTPS. DNS only to internal resolvers. Default-deny on all other protocols with a documented allowlist. Network segmentation so that a workstation compromise does not let the attacker pivot to servers via unrestricted ports.

Detail in the internal pen-test playbook; see also network penetration testing.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp