Offensive Data Exfiltration Methods
Teaches an agent red-team techniques for smuggling data out of a target network via DNS, HTTPS, ICMP and cloud channels.
- Repository
- SnailSploit/Claude-Red
- Stars
- 10,230
- Licence
- MIT
- Files
- 1 file
What it does
This is a playbook that teaches an AI agent how to move data out of a compromised network without being noticed. It covers covert channels such as DNS queries, HTTPS tunnels, ICMP ping packets, cloud storage links, email, and hidden data in images or documents, along with encryption, chunking, slow transfer rates and cleanup steps. It is written for penetration testers and red teams and is labeled for authorized engagements, but the content itself is operational attacker tradecraft, and the agent will follow it when asked.
Great for
- Security professionals on authorized red team or penetration testing engagements who need a reference for exfiltration techniques to test detection
- Blue team and detection engineers who want to understand which exfiltration channels to monitor
- Students of offensive security studying MITRE ATT&CK exfiltration techniques
Skip it if
- Anyone without written authorization to test the target: the skill provides ready-made methods for stealing data and evading detection, and nothing in the file verifies authorization
- Routine data transfer or backup work: the techniques are designed to avoid detection and bypass controls, so they are the wrong tools and carry legal risk
- Non-technical users looking for a simple file-sharing helper: the content is dense, tool-specific and assumes deep networking knowledge
Try asking
- “Walk me through DNS exfiltration options for a red team engagement where only port 53 is open.”
- “Show how to chunk and encrypt a staged archive before sending it over HTTPS in a detection-evasion exercise.”
- “Which covert channels should I test to see whether our SOC detects ICMP tunneling?”
- “Generate a checklist for the post-exploitation exfiltration phase of an authorized assessment.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
offensive-data-exfiltration.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip offensive-data-exfiltration.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip offensive-data-exfiltration.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Use it only inside a scoped, written engagement, and tell the agent the authorization context so it can scope its output to test plans and detection criteria.
- Ask for detection and defense mapping (which logs or rules would catch each channel) to get value for blue teams rather than operational tooling.
- Treat the outputs as untested: the file contains unverified example code and tool syntax, so validate commands in a lab before relying on them.
What's inside
- SKILL.md
Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.