Which exfiltration method does an attacker use to hide and encode data inside DNS requests and queries?