d00movenok / bounceback

↕️🤫 Stealth redirector for your red team operation security

BounceBack

↕️🤫 Stealth redirector for your red team operation security.

Overview

BounceBack is a powerful, highly customizable and configurable reverse proxy with WAF functionality for hiding your C2/phishing/etc infrastructure from blue teams, sandboxes, scanners, etc. It uses real-time traffic analysis through various filters and their combinations to hide your tools from illegitimate visitors.

The tool is distributed with preconfigured lists of blocked words, blocked and allowed IP addresses.

For more information on tool usage, you may visit project's wiki.

Features

• Highly configurable and customizable filters pipeline with boolean-based concatenation of rules will be able to hide your infrastructure from the most keen blue eyes.
• Easily extendable project structure, everyone can add rules for their own C2.
• Integrated and curated massive blacklist of IPv4 pools and ranges known to be associated with IT Security vendors combined with IP filter to disallow them to use/attack your infrastructure.
• Malleable C2 Profile parser is able to validate inbound HTTP(s) traffic against the Malleable's config and reject invalidated packets.
• Out of the box domain fronting support allows you to hide your infrastructure a little bit more.
• Ability to check the IPv4 address of request against IP Geolocation/reverse lookup data and compare it to specified regular expressions to exclude out peers connecting outside allowed companies, nations, cities, domains, etc.
• All incoming requests may be allowed/disallowed for any time period, so you may configure work time filters.
• Support for multiple proxies with different filter pipelines at one BounceBack instance.
• Verbose logging mechanism allows you to keep track of all incoming requests and events for analyzing blue team behaviour and debug issues.

Rules

The main idea of rules is how BounceBack matches traffic. The tool currently supports the following rule types:

• Boolean-based (and, or, not) rules combinations
• IP and subnet analysis
• IP geolocation fields inspection
• Reverse lookup domain probe
• Raw packet regexp matching
• Malleable C2 profiles traffic validation
• Work (or not) hours rule

Custom rules may be easily added, just register your RuleBaseCreator or RuleWrapperCreator. See already created RuleBaseCreators and RuleWrapperCreators

Rules configuration page may be found here.

Proxies

The proxies section is used to configure where to listen and proxy traffic, which protocol to use and how to chain rules together for traffic filtering. At the moment, BounceBack supports the following protocols:

• HTTP(s) for your web infrastructure
• DNS for your DNS tunnels
• Raw TCP (with or without tls) and UDP for custom protocols

Custom protocols may be easily added, just register your new type in manager. Example proxy realizations may be found here.

Proxies configuration page may be found here.

Installation

Just download latest release from release page, unzip it, edit config file and go on.

If you want to build it from source, clone it (don't forget about GitLFS), install goreleaser and run:

goreleaser release --clean --snapshot

Usage

1. (Optionally) Update banned_ips.txt list:

   bash scripts/collect_banned_ips.sh > data/banned_ips.txt

2. Modify config.yml for your needs. Configure rules to match traffic, proxies to analyze traffic using rules and globals for deep rules configuration.

3. Run BounceBack:

   ./bounceback

   Usage of BounceBack:
   -c, --config string Path to the config file in YAML format (default "config.yml")
   -l, --log string Path to the log file (default "bounceback.log")
   -v, --verbose count Verbose logging (0 = info, 1 = debug, 2+ = trace)

bounceback's Issues

Case sensitive headers bug

So for some reason profiles that are created with the help of the SourcePoint are getting rejected
are blocked even though the host_stage set to false

2023-11-08T13:33:01Z DBG http-get/post/stager did not match from=192.168.1.146 proxy=https_proxy rule=malleable_https_traffic
2023-11-08T13:33:01Z WRN Rejected from=192.168.1.146 proxy=https_proxy rule=malleable_https_traffic

Cannot configure multiple TLS certificates

I have multiple domains resolving to my Nginx server and I configured BounceBack to proxy to the Nginx server. But it doesn't support configuring multiple TLS certificates.

I have a error in port 80

I have an error on port 80, I am using gophish already executed in tmux, any way to resolve if gophish is using it, or change the port to another?

I'm going to try changing the local port in the config

SAME ERROR

Does this work with Havoc c2?

I'm sure it can but since Havoc is going through a major rewrite it might change things up. I'll do some testing today to see what I can do with it. I'll be testing out the yaotl configs for Havoc. Maybe I'll get somewhere. Who knows.

Disable certificate check on proxy target url

Bug:

2023-11-06T15:22:47Z DBG http-get match from=192.168.1.146 match= proxy=https_proxy rule=malleable_https_traffic
2023-11-06T15:22:47Z ERR Can't make proxy request error="Get "https://127.0.0.1:8443/test?param=aGVsbG8gd29ybGQsZnJvbSBibGFja3NudWZraW4K/test": tls: failed to verify certificate: x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs" from=192.168.1.146 proxy=https_proxy

Fix:
/BounceBack/Internals/proxy/http/proxy.go
Line 81:

	if p.TLSConfig != nil {
		p.TLSConfig.InsecureSkipVerify = true // Add this line to skip certificate verification
		p.client.Transport = &http.Transport{
			TLSClientConfig:   p.TLSConfig,
			ForceAttemptHTTP2: true,
		}
		p.server.TLSConfig = p.TLSConfig
	}

	return p, nil

Issues while parsing malleable c2 when string contains only numbers

coundnt parse the malleable c2 with sleep mask token set to 11, couldnt reconize some new params in new profile params. any sample profile to test with? so i can try to tweak maybe ?

1