Data Exfiltration

Web Server

HTTP Server

To host web pages (.html, .js, etc.) on http://localhost:80, cd to file directory and then start the SimpleHTTPServer.

Local HTTP server that displays all requests like a webhook. Also works on Windows 🙂

# Python 2.7
python -m SimpleHTTPServer 80

# Python 3.x
python -m http.server

On Windows, in CMD window:

cd C:\<website directory>
C:\Python27\python.exe -m SimpleHTTPServer 8081

Webhook

Exfiltrate data (e.g. cookies in parameter) with a webhook:

Temporary email addresses

Temporary File Storage

Paste

DNS

See Domain Name System (DNS) – port 53.

Use dnserver.

sudo pip install dnserver

Download example file example_zones.toml.

wget -O zones.toml https://raw.githubusercontent.com/samuelcolvin/dnserver/main/example_zones.toml

Replace example.com by your domain, like myprecious.pwn, in the zones.toml file.

sudo python3 -m dnserver --port 5053 zones.toml

Test:

dig @myprecious.pwn -p 5053 myprecious.pwn MX

Other techniques

  • Use Steganography to embed data into images
  • Rename zip files as .txt and send them by email to evade file type restrictions.