by ytisf

ytisf / PyExfil

A Python Package for Data Exfiltration

523 Stars 113 Forks Last release: almost 4 years ago (v0.9) MIT License 81 Commits 4 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:


Stress Testing Detection & Creativity

Contributions Welcome HitCount PyPI download month PyPI license GitHub stars made-with-python


PyExfil was born as a PoC and kind of a playground and grew to be something a bit more. In my eyes it's still a messy PoC that needs a lot more work and testing to become

. The purpose of PyExfil is to set as many exfiltration, and now also communication, techniques that CAN be used by various threat actors/malware around to bypass various detection and mitigation tools and techniques. You can track changes at the official GitHub page.

Putting it simply, it's meant to be used as a testing tool rather than an actual Red Teaming tool. Although most techniques and methods should be easily ported and compiled to various operating systems, some stable some experimental, the transmission mechanism should be stable on all techniques. Clone it, deploy on a node in your organization and see which systems can catch which techniques.

Getting Started


For using

(not necessarily the most updated):
pip install --user PyExfil


For source:

git clone
cd PyExfil
pip install --user -r requirements.txt

We recommend installing

as well so that you may cross compile various modules to a binary for easier transportation. You can do that with:

pip install py2exe


Go to the same folder where

was cloned to and:
pip --user install

List of Techniques

For usage per modules have a look at the USAGE file.

Data Generation

Although this tool was initially created as a game and later on turned to be a Red Team oriented tool, at the end of a day a major usage of

is to test various DLP (Data Leakage Protection) systems as well as detection of intrusion. To make the latter mission simpler we have created a little module to generate fake data with a structure that matches both PII and PCI data sets. These are intended to trigger alerts while being broadcate outside of the network.

Here is how to use it:

from pyexfil.includes import CreateTestData

c = CreateTestData(rows=1000, output_location="/tmp/list.csv") c.Run()

After this you can use which ever

module you would like to try and exfiltrate the data set created. This way you can test your detection without risking exfiltrating valuable data.


We welcome it! From testing, to improving quality of code and up to entirely new methods.

Future Changes


For details about version look at the tags on this repository.

Version 1.0.0!

  • [x] Surprise on restructure (Add Another).
  • [x] Split
    to two different files.
  • [x] Get a nice logo.
  • [x] Uniform calling convention for newer modules.
  • [x] Exfiltration data-set generator (PII&PCI).

Version 1.3 - Harpax:

  • [x] Adding 4 new modules.
  • [x] General fixups.
  • [x] Some old modules recoded to fit new standard.
  • [x] Full compatibility between Python2 and Python3.

Version 1.4 - ?:

  • [ ] Expand physical exfiltration channels.
  • [ ] Re-test servers on older modules.
  • [ ] Add file manipulation class (for example, module
    does not fit into any existing category although currently residing under

Hopefully - Close Future

  • [ ] Attempt at creating a more uniform call convention.
  • [ ] Fix that poorly written
  • [ ] Backport all old modules to new calling convention.

In the Distant Future - The Year 2000

  • [ ] Add Golang/C++ support for portability.
  • [ ] Extensive testing for py2exe support.


People & Companies

  • Big shout out to JetBrains!!!
  • Thanks to barachy and AM for ideas on protocols to use.
  • Thanks to Itzik Kotler for some ideas.
  • Shout out to @cac0ns3c for resolving some dependency hell.


  • Thanks Wireshark for your awesome wiki and tool. Especially packet dumps.
  • Shout out to the nmap guys.
  • Thanks to Trey Hunner for the package
  • The Faker package.
  • Special thanks to Thomas Baruchel and Fredrik de Vibe for the txt2pdf package we used in the
    exfiltration package.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.