PyExfil - PyExfil — Python 3 toolkit for researching and str

项目说明

PyExfil

Stress Testing Detection & Creativity

![Contributions Welcome]()
![HitCount]()
![PyPI download month]()
![PyPI license]()
![GitHub stars]()
![made-with-python]()

!Logo

PyExfil was born as a PoC and kind of a playground and grew to be something a bit more. In my eyes it's still a messy PoC that needs a lot more work and testing to become stable. The purpose of PyExfil is to set as many exfiltration, and now also communication, techniques that CAN be used by threat actors/malware around to bypass detection and mitigation tools and techniques. You can track changes at the official GitHub page.

Putting it simply, it's meant to be used as a testing tool rather than an actual Red Teaming tool. Although most techniques and methods should be easily ported and compiled to operating systems, some stable some experimental, the transmission mechanism should be stable on all techniques. Clone it, deploy on a node in your organization and see which systems can catch which techniques.

Getting Started

PIP

For using pip (not necessarily the most updated):

Prerequisites

For source:

We recommend installing py2exe as well so that you may cross compile modules to a binary for easier transportation. You can do that with:

Installing

Go to the same folder where PyExfil was cloned to and:

List of Techniques

* Network
* DNS query
* HTTP Cookie
* ICMP (8)
* NTP Body
* BGP Open
* HTTPS Replace Certificate
* QUIC - No Certificate
* Slack Exfiltration
* POP3 Authentication (as password) - Idea thanks to Itzik Kotler
* FTP MKDIR - Idea thanks to Itzik Kotler
* Source IP-based Exfiltration
* HTTP Response
* IMAP_Draft
* Communication
* NTP Request
* DropBox LSP (Broadcast or Unicast)
* DNS over TLS
* ARP Broadcast
* JetDirect
* GQUIC - Google Quick UDP Internet Connections (Client Hello)
* MDNS Query - *Can be used as broadcast.*
* AllJoyn. Name Service Protocol (IoT discovery) 0 ISAT.
* PacketSize. Using size of packet rather than actual data.
* UDP-Source-Port Using the source port in UDP as a transmission medium.
* CertExchange Le certificate exchange function for short bursts of communication.
* DNSQ Le DNS Queries for communication.
* ICMP_TTL Le the TTL byte for communication. Very short but also stealthy.
* Physical
* Audio - *No listener*.
* QR Codes
* WiFi - On Payload
* 3.5mm Jack
* UltraSonic
* Steganography
* Binary Offset
* Video Transcript to Dictionary
* Braille Text Document
* PNG Transparency
* ZIPCeption
* DataMatrix over LSB

For usage per modules have a look at the USAGE file.

Data Generation

Although this tool was initially created as a game and later on turned to be a Red Team oriented tool, at the end of a day a major usage of PyExfil is to test DLP (Data Leakage Protection) systems as well as detection of intrusion. To make the latter mission simpler we ha a little module to generate fake data with a structure that matches both PII and PCI data sets. These are intended to trigger alerts while being broadcate outside of the network.

Here is how to use it:

After this you can use which ever PyExfil module you would like to try and exfiltrate the data set created. This way you can test your detection without risking exfiltrating data.

Contributing

We welcome contributions — from testing and bug fixes to entirely new covert channels.

DOCUMENTATION.md — how to write a new module using the class hierarchy, which base class to inherit, and where to register it.

ARCHITECTURE.md — the full class hierarchy reference (NetworkModule, CommModule, PhysicalModule, StegaModule) with API details and examples.

CALL_TO_ACTION.md — a curated list of open tasks: modules that still need con to the new class system, new channel ideas, test co gaps, and Python 3 modernisation work.

If you want to help, start with CALL_TO_ACTION.md — every item there has a file path and clear instructions.

Future Changes

For details about look at the tags on this repository.

1.0.0!

[x] Surprise on restructure (Add Another).

[x] Split DOCUMENTATION.md and README.md to two different files.

[x] Get a nice logo.

[x] Uniform calling con for newer modules.

[x] Exfiltration data-set generator (PII&PCI).

1.3 - Harpax:

[x] Adding 4 new modules.

[x] General fixups.

[x] Some old modules recoded to fit new standard.

[x] Full compatibility between Python2 and Python3.

1.5 - Lorax

[x] Created structure, finally...

[x] Proper documentation on contributing.

[x] Adding CALL_TO_ACTION.md for community assistance.

[x] Fixed some of the older legacy modules.

[x] Adding tests for some basic smoketests. Will add more module oriented tests later on.

Hopefully - Close Future

[x] Attempt at creating a more uniform call con. *See DOCUMENTATION.md*.

[ ] Fix that poorly written *setup.py*.

[ ] Backport all old modules to new calling con.

In the Distant Future - The Year 2000

[ ] Add Golang/C++ support for portability.

[ ] Extensi for py2exe support.

Acknowledgments

People & Companies

Big shout out to JetBrains!!!

Thanks to barachy and AM for ideas on protocols to use.

Thanks to Itzik Kotler for some ideas.

Shout out to for resolving some dependency hell.

Thanks to for pointing out some Python compatibility issues.

Big thanks to for pointing us to pytube3 latest update and support.

Resources

Thanks Wireshark for your awesome wiki and tool. Especially packet dumps.

Shout out to the nmap guys.

Thanks to Trey Hunner for the package names.

The Faker package.

Special thanks to Thomas Baruchel and Fredrik de Vibe for the txt2pdf package we used in the braille exfiltration package.

项目信息

开发语言：Python

Star 数：812

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PyExfil — Python 3 toolkit for researching and stress-testing data exfiltration techniques across network, physical, and steganographic channels. For red team simulation and DLP detection testing.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。