Offensive File Transfer Techniques

A structured, hands-on reference on moving files to and from a target during an engagement — staging payloads and tooling onto a host, and exfiltrating loot back off it — across every practical channel, from full protocol servers (HTTP/SMB/FTP/TFTP/WebDAV) down to raw TCP sockets, SSH copies, living-off-the-land binaries, and a base64 copy-paste when no port is open at all. Written from an offensive-security perspective (transfer, then detect and defend).

[!WARNING] Educational use only These are personal study notes. Every technique here is documented for use only against systems you own or are explicitly authorized to test (your own lab, a CTF, an authorized engagement). Staging and exfiltrating files on a host you do not have written permission to assess is unlawful in most jurisdictions. All examples use lab addresses (10.10.14.x, 127.0.0.1) and placeholder filenames — substitute your own.

What's inside

• 30 notes organized by transport channel, each in a consistent shape: concept → hands-on commands (both directions) → verification → cleanup → related notes.
• Full channel coverage — Python/Apache HTTP & HTTPS servers, custom PUT and PHP POST upload endpoints, impacket-smbserver/Samba + smbclient, FTP (vsftpd/pyftpdlib) & TFTP, WebDAV, netcat/socat//dev/tcp, scp/rsync/sftp, Windows LOLBAS and Linux GTFOBins, base64 no-egress transfer, hash integrity verification, Meterpreter upload/download, and NetExec.
• A dedicated detection & defense note mapping every technique to its host, network, and artefact signals.
• Copy-ready, language-tagged commands throughout; a client-and-server pairing for each protocol.

Map of Content

Servers & frameworks

Note	Covers
File Transfer Servers	Multi-protocol server setup — HTTP/HTTPS, FTP, SFTP, SMB, TFTP
NetExec File Transfers & Execution	NetExec put/get/exec over SMB and WinRM
Meterpreter File Transfer	Built-in upload/download inside a Metasploit session

HTTP / HTTPS

Note	Covers
HTTP Server (index)	Sub-index for the HTTP channel
HTTP/HTTPS Server	Python/Apache servers, custom PUT upload server, TLS
HTTP/HTTPS Client	certutil, wget, curl, PowerShell download/upload
HTTP File Transfer One-Liners	Per-language quick server/download one-liners
PHP HTTP POST Server	A PHP endpoint to receive uploaded files

SMB · FTP · TFTP · WebDAV

Note	Covers
SMB Server · SMB Client	impacket-smbserver/Samba; smbclient, net use, mount.cifs
FTP Server · FTP Client Commands	vsftpd/pyftpdlib/msf; full interactive FTP client
TFTP Server · TFTP Client	tftpd-hpa/atftpd/msf; Windows/Linux TFTP client
WebDAV File Transfer	SMB semantics over HTTP — for when port 445 egress is blocked

Raw sockets & shells

Note	Covers
Netcat and Socat (index)	Overview of raw-socket transfers
Netcat File Transfer	nc both directions, Windows nc64.exe, tar-over-nc
Socat File Transfer	Plain and TLS-encrypted transfers
/dev/tcp Bash Transfer	Pure-bash transfer when no client binary exists

SSH-based

Note	Covers
SCP and Rsync (index)	Overview of SSH-based transfers
SCP File Transfer	scp up/down, recursive, keys, ports
Rsync File Transfer	Delta/resumable sync over SSH and via the rsync:// daemon
SFTP Client	Interactive sftp get/put sessions

Living off the land

Note	Covers
Living off the Land (index)	LOLBAS/GTFOBins framing
Windows LOLBAS File Transfer	certutil, bitsadmin, curl.exe, MpCmdRun, esentutl, findstr
Linux GTFOBins File Transfer	openssl, python, php, perl, ruby downloaders

No-egress transfer & integrity

Note	Covers
Encoding and Integrity (index)	Overview
Base64 Copy-Paste Transfer	Move a file through the shell with zero open ports
Integrity Verification	sha256sum/certutil -hashfile/Get-FileHash

Detection & defense

Note	Covers
Detecting File Transfers	Host, network, and artefact signals; controls that blunt each technique

How to read

• On GitHub — every note is fully readable and its cross-references are relative Markdown links clickable directly in the GitHub web UI; tables and alert callouts render inline. Start here and follow the Map of Content.
• Also great in Obsidian — clone the repo and open the folder as a vault. The same relative links resolve, so click-through navigation, backlinks, and the graph view all work.

Conventions

• Commands are written for Kali Linux and a Windows target unless noted; adapt IPs, interface names, and paths to your environment.
• IP addresses (10.10.14.7 attacker, 10.10.10.5 target), ports, and filenames (nc64.exe, loot.tar.gz) are lab placeholders — replace them with your own.
• Callouts use GitHub alert syntax (> [!NOTE], > [!WARNING], > [!TIP]) and bold-label blockquotes; both render on GitHub and in Obsidian.
• Every transfer note pairs a verification (hash check) and cleanup step — a dropped byte is never reported by these channels.

License

Content is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0) — you may share and adapt it with attribution. All techniques are documented for authorized testing and education only; verify every command in an isolated lab before use.