Data Exfiltration

Data exfiltration is the final step: getting collected data off the target and back to you. The method depends on what protocols are allowed outbound, what monitoring is in place, and how much data you need to move.

Staging and packaging come first. Compress, encrypt, and split files to avoid detection and simplify transfer. Then choose the channel: HTTP/S, DNS tunneling, ICMP, or even allowed cloud services.

The techniques below cover data staging, packaging for transfer, and multiple exfiltration methods ranging from simple file transfers to covert channels.