Serving Random Payloads with Apache mod_rewrite
As testers, we sometimes need some good, old-fashioned trial and error to get things working. Phishing is one of the attacks that commonly takes more than one attempt to get payloads and command and control (C2) working properly. This post covers how to help effectively perform payload trial and error by randomly serving payloads from one URL with Apache mod_rewrite. The technique described in this post lends itself more to a penetration test, where email phishing batches may span an entire target company, rather than a red team assessment, where email phishing is highly targeted and payload issues are painstakingly troubleshot manually. Following the steps below, we can configure an Apache redirector, or server directly, to serve a random payload from a predefined list of possible payloads with the RewriteMap - randomized plain text functionality of Apache. Apache’s RewriteMap function allows external programs, such as scripts, databases, or text files to remap requests for Apache to serve. The example commonly used in the official documentation is if a store changes from a URL structure of item-1234 to iPhone-7-white, the web administrators could use Apache to serve up iPhone-7-white when item-1234 is requested without having to change any hard coded links.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
Explore the top million websites, ranked by referring subnets, and gain insights into online influence and popularity.
A digital archive of the internet, allowing users to capture and browse archived web pages.
Generates randomized C2 profiles for Cobalt Strike to evade detection.
SharpEDRChecker scans system components to detect security products and tools.
BeEF is a specialized penetration testing tool for exploiting web browser vulnerabilities to assess security.
A collection of Python scripts for password spraying attacks against Lync/S4B & OWA, featuring Atomizer, Vaporizer, Aerosol, and Spindrift tools.
AzureC2Relay enhances security by validating and relaying Cobalt Strike beacon traffic through Azure Functions.
C3 is a framework for creating custom C2 channels, integrating with existing offensive toolkits.
SharpPrinter enables efficient discovery of network printers for security and management purposes.
PINNED
Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.