The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides comprehensive methodologies and functional code for exfiltrating sensitive information through multiple egress channels.
Implements DNS exfiltration techniques using TXT and CNAME records, including 'slow-drip' methods designed to evade entropy-based detection.
Provides instructions for HTTPS tunneling and domain fronting to mask data theft as legitimate web traffic to CDNs.
Contains functional code for ICMP tunneling, allowing data to be hidden inside ping packets.
Facilitates exfiltration to cloud storage providers (AWS S3, Azure, GCS) using presigned URLs and SAS tokens that require no authentication on the target host.
Abuses legitimate services such as Slack webhooks, GitHub Gists, and Pastebin for data transit.
Details an email-based 'draft method' where data is saved in account drafts to avoid generating network traffic associated with sent messages.
[CREDENTIALS_UNSAFE]: The skill instructions specifically target the collection of high-value system credentials.
Includes explicit commands to access and download the /etc/shadow file containing system password hashes.
Directs the agent to search for and exfiltrate private SSH keys (id_rsa) from home directories.
[PERSISTENCE]: Provides mechanisms to maintain long-term access and ensure recurring data collection.
Includes Linux cron job configurations to execute exfiltration scripts on a set schedule during business hours to blend with normal traffic.
Provides PowerShell commands to register hidden Windows Scheduled Tasks that trigger exfiltration activities every 30 minutes.
[OBFUSCATION]: Details multiple techniques to conceal data and bypass security inspection.
Implements steganography to hide encrypted data within images (LSB), audio (WAV), and PDF metadata fields.
Provides implementation for network timing channels, which encode data in the duration of delays between transmissions to remain undetectable by traditional traffic analysis.
Includes instructions for HTTP header encoding to hide exfiltrated data within standard protocol headers.
[EXTERNAL_DOWNLOADS]: References and provides links to numerous third-party offensive tools hosted on external repositories, including dnscat2, iodine, chisel, and ptunnel-ng.
[COMMAND_EXECUTION]: Instructs on the use of complex shell and PowerShell pipelines for data staging, including mass file collection, local encryption using AES-256-GCM, and splitting archives into small, stealthy chunks.
[DYNAMIC_EXECUTION]: Contains Python scripts that perform raw socket manipulation for ICMP exfiltration and use the Scapy library to inject data into IP header fields at runtime.

offensive-data-exfiltration