Mod_Rewrite for Red Team Infrastructure
Setting up infrastructure for a Red Team engagement can be time consuming and difficult. Jeff Dimmock and Steve Borosh have done a lot of work to make this process easier and more transparent. They gave a great presentation that went over the fundamentals of setting up good Red Team infrastructure. As part of this effort, they released a wiki. One of the most interesting bits of tradecraft released in this talk and on Jeff's blog is their very creative use of apache2’s mod_rewrite functionality. Mod_Rewrite is very powerful for a few reasons: It can be used to hide the true location of your Teamserver. It can be used to evade detection from Incident Response. It can be used to redirect mobile users away from a payload to a spoofed login portal, to capture credentials. It can be used to block specific IP addresses from your teamserver, to aid in IR evasion. It can be used to only allow your Malleable C2 traffic to the Teamserver. In a Red Team engagement, there are often multiple team servers and multiple redirectors in front of each team server. In the event that a defender identifies and blocks one of the redirectors, they should be easy to recreate. However, manually setting up mod_rewrite rules can be complex and time-consuming.
FEATURES
ALTERNATIVES
DueDLLigence is an open-source tool for identifying and analyzing DLL hijacking vulnerabilities in Windows applications, providing automated analysis and remediation guidance.
Create a vulnerable active directory for testing various Active Directory attacks.
Collection of Windows oneliners for executing arbitrary code and downloading remote payloads.
Tool for exploiting Sixnet RTUs to gain root level access with little effort.
SharpPrinter enables efficient discovery of network printers for security and management purposes.
A cross-platform post-exploitation HTTP/2 Command & Control server and agent dedicated for containerized environments
Phrack Magazine is a digital magazine that focuses on computer security and hacking, featuring articles, interviews, and tutorials on various topics related to computer security.
PINNED
Fabric Platform by BlackStork
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
Mandos Brief Newsletter
Stay ahead in cybersecurity. Get the week's top cybersecurity news and insights in 8 minutes or less.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.