ThreatExploit Documentation logoThreatExploit Documentation logo ThreatExploit Documentation
Advanced Post-Exploitation Exfiltrating Data Securely

Once you have compromised a target and identified high-value assets, the next critical step is extracting that data without triggering network alarms. This guide covers how to locate sensitive information, map secure egress routes, and safely exfiltrate data while measuring the target organization's defensive capabilities.

Threat Modeling Context

Ensure your exfiltration methods simulate the real-world threat actors defined in your engagement's Threat Model.

1. Locating Sensitive Data (Pillaging)

Before you can exfiltrate data, you must locate and stage it. "Pillaging" refers to gathering relevant information—such as personal data, credit card numbers, or proprietary source code—that satisfies the goals defined in your pre-assessment phase.

Data SourceWhat to Look ForValue for Exfiltration
File SharesSource code, backups, installation files, financial spreadsheets, and PDFs.High-impact business data that demonstrates immediate risk if leaked.
DatabasesUser credentials, regulated content (PII/PCI), and application data.Structured sensitive data. Often requires specific queries to locate.
User SystemsBrowser history, chat logs, clear-text password files, and encryption keys.Useful for pivoting or demonstrating the impact of a compromised endpoint.

When hunting for sensitive data in large databases, search column metadata first. For example, to find credit card data in an Oracle database, you might use:

SELECT * FROM all_tab_columns WHERE name LIKE '%CCN%';

Strictly Adhere to Scope: Great care should be taken to only capture data covered under the scope of the engagement. Avoid capturing out-of-scope personal employee data or intercepting local wiretap-protected communications (like VoIP).

2. Mapping Exfiltration Paths

Do not attempt to extract data blindly. You must first map all possible exfiltration paths from the compromised segment to the outside world.

Analyze the network configuration to identify secondary and tertiary means of egress. Look closely at:

  • Routing and Interfaces: Identify gateways and multi-homed hosts that might bridge segmented networks.

  • DNS Servers: Can you use DNS tunneling to bypass egress filtering?

  • Proxy Servers: Application-level proxies are excellent targets for blending your exfiltration traffic with legitimate enterprise traffic.

flowchart LR
    A["Compromised Host"] -->|Stage Data| B["Internal Staging Server"]
    B -->|Bypass Controls| C["Corporate Proxy / DNS"]
    C -->|Encrypted Tunnel| D["Controlled External Server"]

3. Executing the Exfiltration

Once your paths are mapped and your data is staged, begin the extraction process. Your infrastructure must adhere to the customer's acceptable engagement policy (e.g., exfiltrating only to servers fully controlled by the testing team).

  1. 1

    Stage and Archive

    Gather the targeted data into a secure staging area on the compromised network. Compress and encrypt the data (e.g., using password-protected .zip or .7z archives) to evade basic Data Loss Prevention (DLP) signatures.

  2. 2

    Select the Egress Channel

    Choose a protocol that mimics legitimate traffic or matches your threat actor profile. Standard exfiltration might use HTTP/S or FTP, while sophisticated simulations might use covert channels.

  3. 3

    Transfer the Data

    Initiate the transfer to your external infrastructure. Monitor the transfer to ensure the connection remains stable and stealthy.

Advanced Exfiltration Channels

If standard HTTP/HTTPS ports are heavily monitored or blocked, consider these alternative channels:

  • DNS Tunneling: Encoding data within DNS queries. Slow, but often bypasses strict firewalls.

  • ICMP Payload: Hiding data within ping requests.

  • Cloud Services: Exfiltrating data to legitimate third-party cloud storage providers (if permitted by rules of engagement) to blend in with normal employee traffic.

4. Measuring Control Strengths

The primary goal of exfiltration testing isn't just to "steal the data"—it is to evaluate the organization's detection and response capabilities.

As you exfiltrate data, monitor whether the current controls successfully detect or block the sensitive information from leaving the network. This exercise provides invaluable data for the blue team, helping them understand how their incident response procedures hold up against active exfiltration attempts.

5. Post-Exfiltration Cleanup

Once the assessment is complete and the data has been securely transferred, you must remove all traces of your presence to return the environment to its original state.

  • Remove Artifacts: Delete all executables, scripts, staged archives, and temporary files from compromised systems. Use secure deletion methods if possible.

  • Restore Configurations: Revert any system settings, routing tables, or application parameters modified during the assessment.

  • Eliminate Persistence: Remove all installed backdoors, rootkits, or alternate user accounts created for the engagement.