During a security engagement, a tester identifies that outbound connections pass through common web channels with minimal inspection. Which technique best provides a discreet way to move sensitive materials to an offsite server under those restrictions?
Forward confidential data through a privileged secure shell that is established from an external system inbound
Inject unusual packets into broadcast network announcements in hopes they pass filters
Embed stolen files into normal browsing activity with a stealthy agent calling out on common ports
Set up an unencrypted shell listening on a non-standard port that receives the materials directly
Hypertext Transfer Protocol Secure (HTTPS) is generally permitted by web proxies and firewalls. Embedding data transmissions in this traffic allows them to blend in with browsing activity, making it harder for detection tools to flag. Other methods, such as unexpected remote listeners or employing unencrypted sessions, are more likely to stand out and be blocked.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
Why is HTTPS traffic harder to detect for data exfiltration?
Open an interactive chat with Bash
What is a stealthy agent and how does it work in this context?
Open an interactive chat with Bash
Why are methods like unencrypted shells or unusual packets more likely to be blocked?