node011 / digitalocean-app-redirector

Reverse-HTTP Redirector via DigitalOcean Apps Platform

DigitalOcean Apps Reverse-HTTP Redirector

DigitalOcean cloud platform released Platform-as-a-Service offering named Apps . That service is comparable to AWS Elastic Beanstalk and Azure App Services as it may be used by simply supplying customer's code and leaving backend setup stage to DO.

Nowadays cybercriminals are looking for ways to disguise their attacker infrastructures behind well-known and trusted DNS domains, that would evade stringent domain validation engines such as MS Defender for Office365 Safe Links, anti-spam domain-validation systems and others.

There are plenty of different publicly known ways to hide attacker infrastructures behind trusted domains, such as:

1. Domain Fronting (via Azure CDN, StackPath CDN, etc)
2. AWS Lambda, Azure Function & App Services, CloudFlare Workers redirectors
3. Subdomain Hijacking
4. Domain Borrowing

This Flask application will act as a reverse-proxy allowing us to host landing-sites, phishing pages or even C2 communication through https://your-application-name.ondigitalocean.app URL.

Installation

0. Clone this repository to your own Github/Gitlab account: https://github.com/mgeeky/digitalocean-app-redirector.git

After cloning it, edit the server.py to set up your Teamserver URL where that redirector should redirect inbound requests:

1. Go to: https://cloud.digitalocean.com/apps

2. Click "Create App"

3. Connect Digital Ocean with your Github

4. Authorize DigitalOcean OAuth2 registration:

5. Select your repository back in DigitalOcean

6. Change Run command to following & change port to 443:

	waitress-serve --port 443 --call server:create_app

7. Click "Next"

8. Select a name for your application:

9. Pick "Basic App" plan and change Basic Size to 5$/mo :

10. Click "Launch Basic App"

11. Now wait :)

12. Then you should have it:

https://atr-test-1-6wx7u.ondigitalocean.app/

Now the resulting URL is a domain to be used by your Implants to egress their connectivity outside of compromised environment.

More information:

• https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/

---

☕ Show Support ☕

This and other projects are outcome of sleepless nights and plenty of hard work. If you like what I do and appreciate that I always give back to the community, Consider buying me a coffee (or better a beer) just to say thank you! 💪

---

Mariusz Banach / mgeeky, (@mariuszbit)
<mb [at] binary-offensive.com>