Post-Exploitation and Lateral Movement · Topic 5 of 5
Staging and Exfiltration
Understand staging and exfiltration: covert channels over DNS, ICMP and HTTPS, alternate data streams, cloud paths and the controls that detect them.
- 4 min
- Staging prepares data by compressing, encrypting, hiding in alternate data streams or collecting on a mounted drive.
- A covert channel hides data movement inside normal-looking traffic.
- DNS and ICMP tunnelling abuse protocols that are often allowed out with little inspection.
What it is
Staging is gathering and preparing data before it leaves a network. Exfiltration is moving that data out. In a penetration test these are demonstrated only to prove the risk and within the rules of engagement, never to remove real client data.
The exam expects you to recognise the staging methods and covert channels by name, and to match each to the control that detects or blocks it. The defender's goal is data loss prevention and monitoring that spots data leaving in unusual ways.
How it works
Staging
Before moving data, an attacker usually prepares it so it is smaller and harder to inspect.
| Method | Idea |
|---|---|
| Compression | Shrinking files so transfer is faster and less obvious |
| Encryption | Hiding the content so inspection tools cannot read it |
| Alternate data streams | Hiding data in a secondary New Technology File System (NTFS) stream attached to a file |
| Virtual drive mounting | Mounting a disk image or virtual drive to collect files in one place |
Encryption and compression make the data opaque, so defenders focus on the fact that data is moving rather than on its content. Alternate data streams are an NTFS feature that can conceal staged data from a casual file listing.
Covert channels
A covert channel hides the movement of data inside traffic that looks normal, so it passes controls that only watch obvious paths.
| Channel | Idea | Control |
|---|---|---|
| Domain Name System (DNS) tunnelling | Encoding data inside DNS queries and responses | Monitor DNS volume and unusual query patterns |
| Internet Control Message Protocol (ICMP) tunnelling | Placing data in echo request and reply payloads | Inspect or limit ICMP payloads |
| Hypertext Transfer Protocol Secure (HTTPS) | Blending exfiltration with ordinary encrypted web traffic | TLS inspection where allowed, egress filtering, data loss prevention |
DNS and ICMP are often allowed outbound with little inspection, which is why they are used as covert channels. HTTPS is attractive because it is both encrypted and everywhere.
Other paths
| Path | Idea | Control |
|---|---|---|
| Steganography | Hiding data inside images or other files | Content inspection, anomaly detection |
| Sending data out as a message or attachment | Data loss prevention on mail | |
| Cloud storage | Uploading to an external storage service | Egress control, allow lists, monitoring |
| Cross-account resources | Moving data to another cloud account through a shared or cross-account resource | Tight cross-account policies, audit logging |
| Text storage (paste) sites | Posting data to a public paste service | Web filtering, data loss prevention |
Cloud paths matter because data can leave through an identity and a shared resource rather than across the network edge, so cloud audit logs are a key source.
In a test, never exfiltrate real sensitive data; use marked sample data or a count, and record every channel used so it can be shown to the client and cleaned up.
What to remember for the exam
- Staging prepares data by compressing, encrypting, hiding in alternate data streams or collecting on a mounted drive.
- A covert channel hides data movement inside normal-looking traffic.
- DNS and ICMP tunnelling abuse protocols that are often allowed out with little inspection.
- HTTPS blends exfiltration with ordinary encrypted traffic.
- Steganography hides data inside images or files.
- Cloud storage, cross-account resources and paste sites are common exfiltration destinations.
- Data loss prevention, egress filtering and DNS monitoring are the main controls.
- Cloud audit logs catch data that leaves through identities rather than the network edge.
Common mistakes
Watching only the network edge. Cloud and email paths can move data without crossing a traditional perimeter.
Ignoring DNS. DNS tunnelling is easy to miss because DNS is usually trusted and allowed outbound.
Assuming encrypted traffic is safe. HTTPS hides content, so defenders must watch volume, destination and behaviour.
Forgetting alternate data streams. Staged data hidden in an NTFS stream will not appear in a normal file listing.
Exfiltrating real data in a test. Proving the channel with safe sample data avoids creating a genuine breach.
Check yourself
Why are DNS and ICMP used as covert channels?
They are often allowed outbound with little inspection, so data hidden in them can slip past controls.
What is an NTFS alternate data stream used for in staging?
Hiding data in a secondary stream attached to a file, so it does not show in a normal file listing.
Which control best addresses exfiltration to cloud storage?
Egress control and data loss prevention, supported by cloud audit logging and allow lists.
Topic 5 of 5 in Post-Exploitation and Lateral Movement
Test yourself on Post-Exploitation and Lateral Movement
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.