Data Exfiltration -- Offensive Methodology

Quick Workflow

1. Inventory target data. Map files, databases, credentials. Assess volume and classification.
2. Stage. Copy to a controlled directory. Strip unnecessary metadata and deduplicate.
3. Compress and split. Tar/zip, then chunk for your channel (DNS < 253 bytes/label; HTTPS tolerates MB).
4. Encrypt. AES-256-GCM or ChaCha20 every chunk. Never exfiltrate plaintext.
5. Select channel. DNS (port 53 only), HTTPS (web allowed), ICMP (ping allowed), cloud (SaaS access).
6. Transmit. Slow-drip for stealth; burst when you have a short window. Match baseline traffic rates.
7. Verify receipt. Recompute SHA-256 on the receiving end and compare against source manifest.
8. Clean up. Securely delete staging, temp files, dropped tools, and any scheduled tasks.

DNS Exfiltration

MITRE: T1048.003 -- Exfiltration Over Alternative Protocol: DNS