On: Exfiltrate Files with DNS Queries

This seems to use base64, DNS is case insensitive so really it should use base32 or some other encoding scheme. However DNS is usually case preserving so it will likely work.

Unless the recursive nameserver in use happens to implement this hack for improved security: http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00

Supported in Unbound with `use-caps-for-id` http://www.unbound.net/documentation/unbound.conf.html

I love unbound.

There's a comment in the source code about b64:

# If you don't like non-valid characters in the hostname,

# then use hex encoding rather than base64

So far, I've not encountered a failure using b64 encoding. But that could be an issue. And as you say, other encodings could be used if that does prove to be a problem.