Preliminary research

Exfiltration using numeric-only outputs

ikaes · ikaes

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from April through September. Unranked, incomplete, not community-vetted, and subject to change.

When an injection sink returns only decimal digits and blocks errors, timing and outbound traffic, command output can still be converted into large base-10 integers. Base-36 or base-27 encoding plus chunking makes the numeric results practical to decode and exfiltrate.

Record

Researcher

ikaes

Published by

ikaes

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• command-injection
• data-exfiltration
• encoding
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of ikaes, first published at the original source. Preserved copies are kept so the citation survives its host.