hak5
/
packetsquirrel-payloads
mirror of https://github.com/hak5/packetsquirrel-payloads.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update readme.md

pull/44/head
0i41E 2024-08-03 21:45:56 +02:00 committed by GitHub
parent def28f9150
commit ff400cb05f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 16 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
payloads/interception/Proxquirrel/readme.md
View File

@ -1,7 +1,7 @@
# Proxquirrel # Proxquirrel
#### Author: #### Author:
**Proxquirrel** is a payload designed for the [Package Squirrel MK II](https://shop.hak5.org/products/packet-squirrel-mark-ii) in combination with a HTTP proxy, like [BurpSuite](https://portswigger.net/burp/releases/professional-community-2024-5-5?requestededition=community&requestedplatform=). **Proxquirrel** is a payload designed for the [Packet Squirrel MK II](https://shop.hak5.org/products/packet-squirrel-mark-ii) in combination with a HTTP proxy, like [BurpSuite](https://portswigger.net/burp/releases/professional-community-2024-5-5?requestededition=community&requestedplatform=).
This payload will redirect common web ports like 80 and 443 and therefore enables the user to intercept such traffic with an external proxy and tinker with its content. This payload will redirect common web ports like 80 and 443 and therefore enables the user to intercept such traffic with an external proxy and tinker with its content.
@ -11,14 +11,21 @@ Before deploying the Squirrel as also the payload, the user has to configure the
Set `PROXY_ADDRESS` and `PROXY_PORT`. This has to be the proxy (server). Set `PROXY_ADDRESS` and `PROXY_PORT`. This has to be the proxy (server).
The other options are optional and can be changed, if needed. The other options are optional and can be changed, if needed.
#### BurpSuite #### BurpSuite
Start up BurpSuite and navigate to the *Proxy* tab and open up the options. Start up BurpSuite and navigate to the *Proxy* tab and open up the *Proxy Settings*.
BILD
Here you have to edit the *proxy listener*. Here you have to edit the *proxy listener*.
Set the *bind address* to either the interface accessible by the Squirrel or simply select *All Interfaces*.
BILD ![1](https://github.com/user-attachments/assets/875a0ce2-7378-4dc4-8027-d1b2ea7c48a8)
Set the *bind address* to either an interface accessible by the Squirrel or simply select *All Interfaces*.
![2](https://github.com/user-attachments/assets/af79f9e7-8d2c-4bc0-8e93-57b477ab4299)
*The payload will automatically verify the connection. If the proxy can't be reached, the payload will fall into a loop, until the proxy (server) is accessible.* *The payload will automatically verify the connection. If the proxy can't be reached, the payload will fall into a loop, until the proxy (server) is accessible.*
For the last step, we have to check *Support invisible proxying* under the *Request handling* tab. For the last step, we have to check *Support invisible proxying* under the *Request handling* tab.
![3](https://github.com/user-attachments/assets/3ae5bbbd-0695-46cd-a076-2a4d30d6feb0)
In this mode, BurpSuite intercepts traffic that is not specifically directed at a proxy. It acts as an intermediary without requiring the client to be configured for a proxy. This is useful for intercepting traffic from devices or applications that do not allow for proxy configuration. (Or in this case, do not know about it) In this mode, BurpSuite intercepts traffic that is not specifically directed at a proxy. It acts as an intermediary without requiring the client to be configured for a proxy. This is useful for intercepting traffic from devices or applications that do not allow for proxy configuration. (Or in this case, do not know about it)
Traffic to ports 80 & 443 should now be redirected to your proxy. Traffic to ports 80 & 443 should now be redirected to your proxy.
@ -30,7 +37,7 @@ To revert the changes on the Squirrel, press the button to perform a cleanup.
### Opsec Considerations ### Opsec Considerations
Since this payload performs some sort of interception of the targets traffic, the target-user may encounter multiple issues: Since this payload performs some sort of interception of the targets traffic, the target-user may encounter multiple issues:
- Security warnings about the connection to a web page not being secure. - Security warnings about the connection to a web page not being secure.
- Not being able to use certain web applications due to HSTS. - Not being able to use certain web applications due to HSTS.
- Sensitive information may be visible within the intercepted requests and should be handled with care. - Sensitive information may be visible within the intercepted requests and should be handled with care.
- The user may be blocked by certain WAF's - The user may be blocked by certain WAF's