Covert/steganographic data exfiltration over DNS

TL;DR: data breach via DNS
Can you do something like this:
Export a database to a .mdf file, then convert it to base64, maybe encrypt and hash or something too.

Then the file is basically a text string. A really, really, long text string. But still text. Or it can be broken up into multiple parts. The details aren't really important, it's just hypothetical. And subdomains (and thus domain name lookups) are text.

For the sake of simplicity, let's say the entire string of the hashed base64-encoded file is this:
aaaaaaaaaabbbbbbbbbbccccccccccddddddddddeeeeeeeeeeffffffffff

Then you could do dns lookups, like so:
aaaaaaaaaa.example.com
bbbbbbbbbb.example.com
cccccccccc.example.com
dddddddddd.example.com
eeeeeeeeee.example.com
ffffffffff.example.com

And then the DNS server receiving the lookup requests would know the entire file is aaaaaaaaaabbbbbbbbbbccccccccccddddddddddeeeeeeeeeeffffffffff if it adds the subdomain portions together.

Thoughts?

This is something that could be useful for a penetration test or security audit. Exfiltrate a portion of a database as a proof of their insecurity. But it would only be okay to do so if you have explicit permission to do so (as part of a written legal agreement for a pen test).

suck my dick

sure, why the hell not? but it would be impractical for large datasets, and honestly those are the ones that are most worth exfiltrating. what about using this trick for malware C&C though?

>>3
Don't people say C2 instead of C&C these days? And besides, wouldn't it have to be bidirectional? How could you use subdomain lookups for sending and receiving commands?

>>4
hmm, your're are right,that would require hosting a DNS server on an infected machine which isn't optimal because muh firewalls

If you have read access to a database and an internet connection, why would you bother with this

>>6
obfuscation/stegano

>>6

HTTP, HTTPS, and SSH traffic is usually monitored more than DNS. As such, it makes sense to use something that is less likely to be detected by an IDS or SIEM.