Data Exfiltration

📝 Overview

What it is: The unauthorized transfer of sensitive information from a target network to an attacker-controlled system. Target Phase: attack postexploitation Operating System: Cross-platform

⚙️ Core Methods

• HTTPS/Web Services: High-speed, encrypted, and blends with standard web traffic.
• DNS Tunneling: Using tools like dnscat2 or iodine. Extremely stealthy but very low bandwidth.
• ICMP Tunneling: Hiding data inside “Ping” packets. Often blocked by firewalls but useful if ICMP is allowed outbound.
• Cloud Storage: Uploading data directly to legitimate services (S3 buckets, Dropbox) to bypass domain-based filtering.

💻 Common CLItool options

Tool	Protocol	Note
curl / wget	HTTP/S	Used to POST data to a remote server.
dnscat2	DNS	High stealth, low speed.
rclone	Multiple	Syncs data to cloud providers; very common in ransomware attacks.

🏷️ Tags

attack postexploitation Exfiltration NetworkSecurity DataDiscovery PenTestPlus CLItool