# Data Exfiltration

> Extract data from open Elasticsearch via scroll API and bulk export

- **URL:** https://hackindex.io/services/elasticsearch/data-exfiltration
- **Service:** [Elasticsearch](https://hackindex.io/services/elasticsearch.md)
- **Tags:** exfiltration, extraction, impact
- **Published:** 2026-03-26
- **Updated:** 2026-03-29

Once you have access to an Elasticsearch cluster, the next step is pulling data out. Indices often hold credentials, PII, application logs, and internal documents that were never meant to be queryable from the outside.

Bulk API calls and scroll queries let you dump entire indices efficiently. Snapshot repositories, when writable, offer another path: create a snapshot to a location you control and restore it offline.

The techniques below cover query-based extraction for targeted pulls, bulk dumping for full index retrieval, and snapshot abuse for large-scale exfiltration.

## Guides

- [Extracting Data from Unauthenticated Elasticsearch](https://hackindex.io/services/elasticsearch/data-exfiltration/extracting-data-from-unauthenticated-elasticsearch.md)