Waiting for goDoH

This report describes a technique for covert command-and-control and data exfiltration using DNS-over-HTTPS (DoH), demonstrated with the "godoh" proof-of-concept tool. It adapts traditional DNS tunneling to leverage HTTPS connections to trusted DoH providers (e.g., Google), enabling TXT-based tasking and A-record-based data return while complicating network monitoring and controls that rely on classic DNS visibility. The author details the agent–C2 protocol, operational workflow (encryption, encoding, chunking, control flags), performance trade-offs, and defensive considerations (e.g., split-horizon DNS, request size/rate analysis, label inspection), emphasizing the increased detection complexity when DNS is proxied over HTTPS.