Offensive File Transfer Techniques

A structured, hands-on reference on moving files to and from a target during an engagement — staging payloads and tooling onto a host, and exfiltrating loot back off it — across every practical channel, from full protocol servers (HTTP/SMB/FTP/TFTP/WebDAV) down to raw TCP sockets, SSH copies, living-off-the-land binaries, and a base64 copy-paste when no port is open at all. Written from an offensive-security perspective (transfer, then detect and defend).

Warning

Educational use only These are personal study notes. Every technique here is documented for use only against systems you own or are explicitly authorized to test (your own lab, a CTF, an authorized engagement). Staging and exfiltrating files on a host you do not have written permission to assess is unlawful in most jurisdictions. All examples use lab addresses (10.10.14.x, 127.0.0.1) and placeholder filenames — substitute your own.

What's inside

• 30 notes organized by transport channel, each in a consistent shape: concept → hands-on commands (both directions) → verification → cleanup → related notes.
• Full channel coverage — Python/Apache HTTP & HTTPS servers, custom PUT and PHP POST upload endpoints, impacket-smbserver/Samba + smbclient, FTP (vsftpd/pyftpdlib) & TFTP, WebDAV, netcat/socat//dev/tcp, scp/rsync/sftp, Windows LOLBAS and Linux GTFOBins, base64 no-egress transfer, hash integrity verification, Meterpreter upload/download, and NetExec.
• A dedicated detection & defense note mapping every technique to its host, network, and artefact signals.
• Copy-ready, language-tagged commands throughout; a client-and-server pairing for each protocol.

Map of Content

Servers & frameworks

Note	Covers
File Transfer Servers	Multi-protocol server setup — HTTP/HTTPS, FTP, SFTP, SMB, TFTP
NetExec File Transfers & Execution	NetExec put/get/exec over SMB and WinRM
Meterpreter File Transfer	Built-in upload/download inside a Metasploit session

HTTP / HTTPS

Note	Covers
HTTP Server (index)	Sub-index for the HTTP channel
HTTP/HTTPS Server	Python/Apache servers, custom PUT upload server, TLS
HTTP/HTTPS Client	certutil, wget, curl, PowerShell download/upload
HTTP File Transfer One-Liners	Per-language quick server/download one-liners
PHP HTTP POST Server	A PHP endpoint to receive uploaded files

SMB · FTP · TFTP · WebDAV

Note	Covers
SMB Server · SMB Client	impacket-smbserver/Samba; smbclient, net use, mount.cifs
FTP Server · FTP Client Commands	vsftpd/pyftpdlib/msf; full interactive FTP client
TFTP Server · TFTP Client	tftpd-hpa/atftpd/msf; Windows/Linux TFTP client
WebDAV File Transfer	SMB semantics over HTTP — for when port 445 egress is blocked

Raw sockets & shells

Note	Covers
Netcat and Socat (index)	Overview of raw-socket transfers
Netcat File Transfer	nc both directions, Windows nc64.exe, tar-over-nc
Socat File Transfer	Plain and TLS-encrypted transfers
/dev/tcp Bash Transfer	Pure-bash transfer when no client binary exists

SSH-based

Note	Covers
SCP and Rsync (index)	Overview of SSH-based transfers
SCP File Transfer	scp up/down, recursive, keys, ports
Rsync File Transfer	Delta/resumable sync over SSH and via the rsync:// daemon
SFTP Client	Interactive sftp get/put sessions

Living off the land

Note	Covers
Living off the Land (index)	LOLBAS/GTFOBins framing
Windows LOLBAS File Transfer	certutil, bitsadmin, curl.exe, MpCmdRun, esentutl, findstr
Linux GTFOBins File Transfer	openssl, python, php, perl, ruby downloaders

No-egress transfer & integrity

Note	Covers
Encoding and Integrity (index)	Overview
Base64 Copy-Paste Transfer	Move a file through the shell with zero open ports
Integrity Verification	sha256sum/certutil -hashfile/Get-FileHash

Detection & defense

Note	Covers
Detecting File Transfers	Host, network, and artefact signals; controls that blunt each technique

How to read

• On GitHub — every note is fully readable and its cross-references are relative Markdown links clickable directly in the GitHub web UI; tables and alert callouts render inline. Start here and follow the Map of Content.
• Also great in Obsidian — clone the repo and open the folder as a vault. The same relative links resolve, so click-through navigation, backlinks, and the graph view all work.

Conventions

• Commands are written for Kali Linux and a Windows target unless noted; adapt IPs, interface names, and paths to your environment.
• IP addresses (10.10.14.7 attacker, 10.10.10.5 target), ports, and filenames (nc64.exe, loot.tar.gz) are lab placeholders — replace them with your own.
• Callouts use GitHub alert syntax (> [!NOTE], > [!WARNING], > [!TIP]) and bold-label blockquotes; both render on GitHub and in Obsidian.
• Every transfer note pairs a verification (hash check) and cleanup step — a dropped byte is never reported by these channels.

License

Content is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0) — you may share and adapt it with attribution. All techniques are documented for authorized testing and education only; verify every command in an isolated lab before use.