Mod_Rewrite for Red Team Infrastructure
Setting up infrastructure for a Red Team engagement can be time consuming and difficult. Jeff Dimmock and Steve Borosh have done a lot of work to make this process easier and more transparent. They gave a great presentation that went over the fundamentals of setting up good Red Team infrastructure. As part of this effort, they released a wiki. One of the most interesting bits of tradecraft released in this talk and on Jeff's blog is their very creative use of apache2’s mod_rewrite functionality. Mod_Rewrite is very powerful for a few reasons: It can be used to hide the true location of your Teamserver. It can be used to evade detection from Incident Response. It can be used to redirect mobile users away from a payload to a spoofed login portal, to capture credentials. It can be used to block specific IP addresses from your teamserver, to aid in IR evasion. It can be used to only allow your Malleable C2 traffic to the Teamserver. In a Red Team engagement, there are often multiple team servers and multiple redirectors in front of each team server. In the event that a defender identifies and blocks one of the redirectors, they should be easy to recreate. However, manually setting up mod_rewrite rules can be complex and time-consuming.
FEATURES
ALTERNATIVES
A collection of tips and tricks for container and container orchestration hacking
A tool to remove malicious artifacts from Microsoft Office documents, preventing malware infections and data breaches.
A free online wargame for practicing hacking skills and learning security concepts.
Pwndrop is a self-deployable file hosting service for red teamers, allowing easy upload and sharing of payloads over HTTP and WebDAV.
Darkarmour is a Windows AV evasion tool that helps bypass antivirus software, allowing for the creation of undetectable malware.
Tool for enumerating proxy configurations and generating CobaltStrike-compatible shellcode.
Modular framework for web services penetration testing with support for various attacks.
Collection of penetration testing scripts for AWS with a focus on reconnaissance.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
CTIChef.com Detection Feeds
A tiered cyber threat intelligence service providing detection rules from public repositories with varying levels of analysis, processing, and guidance for security teams.
OSINTLeak
OSINTLeak is a tool for discovering and analyzing leaked sensitive information across various online sources to identify potential security risks.
ImmuniWeb® Discovery
ImmuniWeb Discovery is an attack surface management platform that continuously monitors an organization's external digital assets for security vulnerabilities, misconfigurations, and threats across domains, applications, cloud resources, and the dark web.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.