πŸ“‚ 02 - Data Exfiltration

Overview

Notes of this categories will discuss about how to exfiltrate data from inside of a system using different techniques or tools. SQL injection, for example, is a technique that can be used to exfiltrate data from a database in the backend server.


🧠 Techniques

FileCreated
(incomplete) CSP (Content Security Policy) BypassMay 22, 2026
(incomplete) CSS InjectionMay 21, 2026
(incomplete) CVE-2026-27944May 21, 2026
(incomplete) GraphQL - IDOR via Insecure ResolversMay 21, 2026
(incomplete) GraphQL - Injection AttackMay 21, 2026
(incomplete) Local File InclusionMay 21, 2026
(incomplete) NoSQL InjectionMay 21, 2026
(incomplete) SQLi - Prepare Statement FailuresMay 26, 2026
Cross-site ScriptingMay 22, 2026
JavaScript - Prototype PollutionApril 12, 2026
ORM & NoSQL InjectionMonday, April 27th 2026, 8:21:48 am
ORM Injection - PrismaMonday, April 27th 2026, 9:09:16 am
Path TraversalTuesday, March 24th 2026, 5:38:33 am
Server-side Request ForgeryMay 21, 2026
SQLi - Boolean-based BlindMonday, March 16th 2026, 10:23:16 am
SQLi - Error-basedMonday, March 16th 2026, 10:24:06 am
SQLi - Time-based BlindMonday, March 16th 2026, 10:23:40 am
SQLi - UNION-basedTuesday, February 10th 2026, 10:58:13 pm
SQLi Context - INFriday, March 20th 2026, 5:35:19 pm
SQLi Context - INSERT and UPDATEFriday, March 20th 2026, 5:20:32 pm
SQLi Context - LIKE (wildcards)Monday, March 16th 2026, 2:15:53 pm
SQLi Context - ORDER BYMonday, March 16th 2026, 10:28:30 am
SQLi Context - WHERE and HAVINGMonday, March 16th 2026, 10:27:01 am
XSS - DOM ClobberingWednesday, May 6th 2026, 7:51:54 am

πŸ“¦ Tech Stack

FileCreated
(incomplete) NginxMay 21, 2026

πŸ› οΈ Tools

FileCreated
NetcatSunday, March 22nd 2026, 10:47:12 am
ProxychainsSunday, March 22nd 2026, 10:47:12 am
SQLmapTuesday, February 10th 2026, 10:58:13 pm