HTTP/HTTPS:

Data Exfiltration

HTTP exfil via curl, SQLi, and out-of-band DNS channels

3 guides • Created Dec 28, 2025 • Updated Mar 29, 2026

3 guides

Exfiltrating Database Content via SQLi

Techniques for extracting database contents through SQL injection, covering UNION-based, blind, and out-of-band methods to retrieve sensitive data.

Mar 28, 2026 • 5 min read

Data Exfiltration over HTTP and HTTPS

Covers techniques for tunnelling stolen data over HTTP/HTTPS traffic, exploiting trusted web protocols to bypass DLP controls and evade network detection.

Mar 16, 2026 • 3 min read

Out-of-Band Data Exfiltration

Techniques for exfiltrating data covertly via HTTP/HTTPS using out-of-band channels, bypassing detection through encoded payloads, DNS queries, and indirect communication paths.

Mar 28, 2026 • 2 min read

Web data exfiltration covers techniques for extracting data through web application channels when direct download or copy is not possible. This includes blind SQL injection data extraction, out-of-band exfiltration via DNS and HTTP callbacks, and abusing application features to leak internal data piece by piece.

Common approaches involve DNS-based exfil through XXE or SSRF, HTTP request smuggling to siphon responses, and leveraging file read vulnerabilities to pull config files and database contents through the web layer. Tools like Burp Collaborator, interactsh, and custom callback servers make out-of-band channels practical even through strict firewalls.

The subpages walk through channel selection, encoding strategies for binary data over text-only channels, and evasion techniques for WAFs and DLP systems that inspect outbound traffic.