diff --git a/CHANGELOG b/CHANGELOG index ac079bd..38fcd80 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,7 @@ +## [22.7.4.11.30] - 2022-7-4 +### Added +- Fix inconsistent request IP address and interception IP address Domain fronting + ## [22.6.30.1107] - 2022-6-30 ### Added - Domain fronting Obtain the actual requested IP address diff --git a/README.md b/README.md index f1aba06..3293cb6 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ You can directly download and use the compiled version, or you can download the git clone https://github.com/wikiZ/RedGuard.git cd RedGuard # You can also use upx to compress the compiled file size -go build -ldflags "-s -w" -trimpath +go build -ldflags "-s -w" # Give the tool executable permission and perform initialization operations chmod +x ./RedGuard&&./RedGuard @@ -152,7 +152,7 @@ As shown in the figure above, in the case of unauthorized access, the response i In the above basic interception case, the default interception method is used, that is, the illegal traffic is intercepted by redirection. By modifying the configuration file, we can change the interception method and the redirected site URL. In fact, this The other way is a redirect, which might be more aptly described as hijacking, cloning, since the response status code returned is 200, and the response is taken from another website to mimic the cloned/hijacked website as closely as possible. -Invalid packets can be misrouted according to three strategies: +Invalid packets can be misrouted according to two strategies: - **reset**: Terminate the TCP connection immediately. - **proxy**: Get a response from another website to mimic the cloned/hijacked website as closely as possible. diff --git a/RedGuard.log b/RedGuard.log index dae1c06..f20a917 100644 --- a/RedGuard.log +++ b/RedGuard.log @@ -2136,3 +2136,164 @@ [2022-06-30 10:42:26] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36 [2022-06-30 10:42:26] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169 [2022-06-30 10:42:26] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://360.net +[2022-07-01 09:57:16] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:57:16] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:57:16] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:57:16] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:58:13] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:58:13] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:58:13] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:58:13] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:58:19] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:58:19] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:58:19] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:58:19] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:58:26] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:58:26] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:58:26] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:58:26] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:58:31] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:58:31] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:58:31] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:58:31] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:58:39] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:58:39] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:58:39] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:58:39] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:58:45] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:58:45] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:58:45] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:58:45] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:58:51] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:58:51] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:58:51] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:58:51] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:58:58] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:58:58] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:58:58] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:58:58] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:59:37] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:59:37] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:59:37] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:59:37] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:59:46] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:59:46] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:59:46] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 09:59:46] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:59:52] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 09:59:52] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 09:59:52] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 09:59:52] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:00:31] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:00:31] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:00:31] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:00:31] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:00:38] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:00:38] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:00:38] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:00:38] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:01:15] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:01:15] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:01:15] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:01:15] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:01:21] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:01:21] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:01:21] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:01:21] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:02:39] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:02:39] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:02:39] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:02:39] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:03:07] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:03:07] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:03:07] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:03:07] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:03:19] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:03:19] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:03:19] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:03:19] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:03:26] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:03:26] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:03:26] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:03:26] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:03:38] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:03:38] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:03:38] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:03:38] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:03:47] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:03:47] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:03:47] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:03:47] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:03:59] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:03:59] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:03:59] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:03:59] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:04:41] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d +[2022-07-01 10:04:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /ca +[2022-07-01 10:04:41] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 +[2022-07-01 10:05:11] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:05:11] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:05:11] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:05:11] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:05:16] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 3590d1b8f63dd1d590f0adea4227443d +[2022-07-01 10:05:16] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET /ca +[2022-07-01 10:05:16] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 +[2022-07-01 10:05:16] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169 +[2022-07-01 10:05:16] [RedGuard/core.(*baseHandle).ServeHTTP] [PROXY] Source IP: 127.0.0.1 -> Destination Site: https://360.net +[2022-07-01 10:05:49] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:05:49] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:05:49] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:05:49] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:06:35] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:06:35] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:06:35] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:06:35] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:06:40] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:06:40] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:06:40] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:06:40] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:06:45] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:06:45] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:06:45] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:06:45] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:06:51] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:06:51] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:06:51] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:06:51] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:06:55] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:06:55] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:06:55] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:06:55] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:07:00] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:07:00] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:07:00] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:07:00] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:07:05] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:07:05] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:07:05] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:07:05] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:07:10] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:07:10] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:07:10] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:07:10] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:07:17] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:07:17] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:07:17] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:07:17] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-01 10:07:38] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-01 10:07:38] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-01 10:07:38] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-01 10:07:38] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-04 11:11:03] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-04 11:11:03] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-04 11:11:03] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-04 11:11:03] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-04 11:22:35] [RedGuard/lib.InitGenerateSelfSignedCert] A default SSL certificate is being generated for the reverse proxy... +[2022-07-04 11:22:35] [main.(*cobaltStrike).serverInit] HostTarget: {"360.net":"http://127.0.0.1:8080","360.com":"https://127.0.0.1:4433"} +[2022-07-04 11:22:35] [RedGuard/core.ProxyManger] Proxy Listen Port :443 (HTTPS) +[2022-07-04 11:22:35] [RedGuard/core.ProxyManger] Proxy Listen Port :80 (HTTP) +[2022-07-04 11:22:46] [RedGuard/core.(*baseHandle).ServeHTTP] JA3 FingerPrint: 1575a0ebc250c601e7b83ca4cf6f1d21 +[2022-07-04 11:22:46] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] GET / +[2022-07-04 11:22:46] [RedGuard/core.(*baseHandle).ServeHTTP] [REQUEST] 127.0.0.1 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36 +[2022-07-04 11:22:46] [RedGuard/core.modifyResponse.func1.1] [RESPONSE] HTTP 301 Moved Permanently, length: 169 +[2022-07-04 11:22:46] [RedGuard/core.(*baseHandle).ServeHTTP] [DROP] Source IP: 127.0.0.1 -> Destination Site: https://360.net diff --git a/cert-rsa/ca.crt b/cert-rsa/ca.crt index 2a6f5de..8612ffa 100644 --- a/cert-rsa/ca.crt +++ b/cert-rsa/ca.crt @@ -1,24 +1,24 @@ -----BEGIN CERTIFICATE----- -MIIEFTCCAv2gAwIBAgIIFv1FwrYv9MwwDQYJKoZIhvcNAQELBQAwZjELMAkGA1UE +MIIEFTCCAv2gAwIBAgIIFv6CRztNa1AwDQYJKoZIhvcNAQELBQAwZjELMAkGA1UE BhMCQ04xETAPBgNVBAcTCEhhbmdaaG91MS0wKwYDVQQKEyRBbGliYWJhIChDaGlu YSkgVGVjaG5vbG9neSBDby4sIEx0ZC4xFTATBgNVBAMMDCouYWxpeXVuLmNvbTAe -Fw0yMjA2MzAwMjQyMjBaFw0yMzA2MzAwMjQyMjBaMGYxCzAJBgNVBAYTAkNOMREw +Fw0yMjA3MDQwMzIyMzVaFw0yMzA3MDQwMzIyMzVaMGYxCzAJBgNVBAYTAkNOMREw DwYDVQQHEwhIYW5nWmhvdTEtMCsGA1UEChMkQWxpYmFiYSAoQ2hpbmEpIFRlY2hu b2xvZ3kgQ28uLCBMdGQuMRUwEwYDVQQDDAwqLmFsaXl1bi5jb20wggEiMA0GCSqG -SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8oapqcUeFdoIFhgx7CXQwTVii7+Wx6Puw -Zc6xoDlDx579BL/iSAnJBOC6PL4uZDnzj1iIIVzhD56mMJfVcX4izm3F54V8xHjo -99V9TBcKRtlU0aUos88UtoHjNsZTZqrqaE6ZPRkrTE/bJUkhUEk/Nft3T58EJtHA -+T7oqDLX0wOmSQIwdUpaQHodEE3JJiy+1dH2WAJY6EuRmVgS1Byu7ZYSAX++dylQ -fBlp9VEY8Dc/zRuJHjaPE4AgNO6zrx1PAcAweFEmitkSJ4EdeQInWU+gVpPyV48t -btcgfEn3lSi3ZFTHs9yvvu+qewcJZhk1Es6LcuBSTa5VJPGXNIpVAgMBAAGjgcYw +SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOlbbgaka7fwBiesgQcEm8droXLL5FHXsj +kXEYtE4PJY8pxPmADfYd47CKJ7uHwEHPagJOGmYhYeTrly+d2ZzFSjEP5Oskqoq9 +jWHvdiga+IYcsBNEECGxxsQxIuXiFi0JKC0rgotPOG2Dttu7h98aRya5e38L9kf3 +X+XKdkz4GVeJ1xvS6qr9hfkaUuQfHiEKp9iB2A5/SLZ4RxEgap2n3HJ0gt35KCv9 +/Wt8khljME5h17UJ9n7YcVfvV4Gc41eDJL7XalkUAdtJzvZOy99H2q1VZTsmbswT +wQFDhjB0g/EeaxmngKgFDp+LzJqE2U2WuMg2HyfPcvCzBVrnWWufAgMBAAGjgcYw gcMwDgYDVR0PAQH/BAQDAgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMIGbBgNVHREE gZMwgZCCDCouYWxpeXVuLmNvbYIabWFuYWdlci5jaGFubmVsLmFsaXl1bi5jb22C HCouYWNzLWludGVybmFsLmFsaXl1bmNzLmNvbSKCFCouY29ubmVjdC5hbGl5dW4u Y29tggphbGl5dW4uY29tghB3aG9pcy53d3cubmV0LmNughJ0aWFuY2hpLWdsb2Jh -bC5jb20wDQYJKoZIhvcNAQELBQADggEBALu0PXsdK7oZspNRPhdzlRHlvKiHvESl -Ip0eN6Q+0y5a+dgbo99YsnpYLzc9ZoNhfXb7Ksxk9gnA+7n4XNM6aKIh2SL6zptX -wwOTrccOlNmekl4sHszw8MCOGguJk3mcW1LeKpNHdMoWdom2/CN7Ja+ew1tHeMVe -aZUAqi1sOB7C+52SeyrYfZAuQickyy1NdPiJMI8ojNxgdErqLvuu4ZUOJ3XlzQQi -OM4/CYAQNeqMyrzc089kjplL9WwyCDj5jtz971OTedfTT0KVVLRrkFT0fx+mwbGV -4uG+7iKtFH/uYiBpB9GV8q0JUMie4k8zsnk5F84y7OhLB0noVcmT3NE= +bC5jb20wDQYJKoZIhvcNAQELBQADggEBAK5e9R/x/zUj5GJ6XyCAdD6S/GC7Gn3Y +5fnV1a1LXEK7kRuiJ4iKruyOwz/D+aSdqvGjgBNU3z76z18jf1KZnnxWt7W1DOmU +Pqi2nKEkilQ+es7tYj8NxyfnPDc1V5P7ecS9bTYtTemlu5V1NpzoeO8cUM8Xc+Oq +w9gtwR62vlmkAwICgUTF8Pfw9/wBhNVVgsLfuYTKfBWyiLy+TuxtrLSIQ9qYtvRr +GRQgx+jKwURxU7ZFuUAMnXUen+WYKdTO0+FSI96k0KJYpZ+MUfSFXSy4FOHo7imP +a5eLziaD5VOy6RNFxd517CzAJoKtKauL5jNzmrEe0jaDRVRQbhwJPw4= -----END CERTIFICATE----- diff --git a/cert-rsa/ca.key b/cert-rsa/ca.key index 1b30eda..ab1a98d 100644 --- a/cert-rsa/ca.key +++ b/cert-rsa/ca.key @@ -1,27 +1,27 @@ -----BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAvKGqanFHhXaCBYYMewl0ME1You/lsej7sGXOsaA5Q8ee/QS/ -4kgJyQTgujy+LmQ5849YiCFc4Q+epjCX1XF+Is5txeeFfMR46PfVfUwXCkbZVNGl -KLPPFLaB4zbGU2aq6mhOmT0ZK0xP2yVJIVBJPzX7d0+fBCbRwPk+6Kgy19MDpkkC -MHVKWkB6HRBNySYsvtXR9lgCWOhLkZlYEtQcru2WEgF/vncpUHwZafVRGPA3P80b -iR42jxOAIDTus68dTwHAMHhRJorZEieBHXkCJ1lPoFaT8lePLW7XIHxJ95Uot2RU -x7Pcr77vqnsHCWYZNRLOi3LgUk2uVSTxlzSKVQIDAQABAoIBAEcEjsaYc5b58SXn -PBeujYIJ/M8Lhu0ejHPzQIh7jFPKej9EZIHrIVP/dCRp7ihFL9RVKb3G4dMSMGbd -cKy5mAW+tnGGIynARs1fUY9k8F+8IOLgM1BJsjNYKzrCSpTn2H18W+sxp6I3jvEw -7oGOWqVjy5M19OZ5PwtqS5cIjGvYrs3y3F9VY/TYVBJvFB3BeJ72KJ20P6St1FRt -t0fq8PXQf/zdQHSJ1/wRr1MeL7D4othp7A6pYn3Gzasgd9Qa3tRwCNVTi8XrPBUN -5mHpfP/N5lUnNieW/gVyc+Iry2uGo3Z/++q3F6WZefcOfPa93BfA0QOnnT1tGvNk -MJKX5sECgYEA38uRFqtqenz2TQr1RPGhm6tPh6NuUxh+huj07zBNcorDNKbx/Y7W -zuRIn2ZTTuLEZnjLQQ6NYFfRMtgYh4hzrj5LvRGcNPaWymIJtaPH8ArFTRifmscC -cp1fogTvc0pl7Jze40BOyyXEmviYu8+fRpAATqM68+0SJDZ7Qwyf2m0CgYEA18ay -lXG51G1WXi3w4mcy/gMqPr8Y8MBog0APDMws43JRX3loOW/IunpgjZ17l0WV36pX -vDfmYSZVdd7c0DPQzsDf36oXodOfn4t4laEpH8sqDlOIICwL/ZPaEnfqE0EoBik3 -6jpRD6oL7o4QUYVnbHkSU18XkGBk5DwDWHBjfokCgYEAlKOYEf54EjK9RB5rGQeD -1ujJQcWCmR5Dq0c+pz7lsZYIYQgg4c/lTDTDJ1vHKTXkTEsedG895ydsguCUKjCu -5KPrmgAASA0fyfujh0jomr4MnVAlcZ+MOKPdyLaOc3yOhcELKNSlgLftBSDoEJWt -rCgojBJOLYTf771f0QCpi2ECgYAcri14jbg8kxfixsp43Wy6tKL92hqvjXOW1oHp -mo3w4XYNca63y7Lrjm6dBCy0S6yDITouK2P0z8qWMzw4dFqx0JMxQIOJn/5cj4ZE -pTo5HqEFbHbwh8pEN03KHKRBUOzH/NyQxpWVtm2FlN54Z3n6whD8gew45YcjixKK -w82FuQKBgQC0I1lKmsBhhkGMNdX4u2RFyPAHQr0Uu1NTjugrH/Lnt4qG9JCVFUZV -ZceIpsvcNdnPuaDGUNl+B/JQSjyW4Gx3x6+HIzu5A7XEFe5tPCaBxWWdCg7bPrk0 -a3XnA+GTH2dlWD05EtBjQxrO3iQhFx/UxncWWjdxEPpFj6fXLgiKfg== +MIIEowIBAAKCAQEAzpW24GpGu38AYnrIEHBJvHa6Fyy+RR17I5FxGLRODyWPKcT5 +gA32HeOwiie7h8BBz2oCThpmIWHk65cvndmcxUoxD+TrJKqKvY1h73YoGviGHLAT +RBAhscbEMSLl4hYtCSgtK4KLTzhtg7bbu4ffGkcmuXt/C/ZH91/lynZM+BlXidcb +0uqq/YX5GlLkHx4hCqfYgdgOf0i2eEcRIGqdp9xydILd+Sgr/f1rfJIZYzBOYde1 +CfZ+2HFX71eBnONXgyS+12pZFAHbSc72TsvfR9qtVWU7Jm7ME8EBQ4YwdIPxHmsZ +p4CoBQ6fi8yahNlNlrjINh8nz3LwswVa51lrnwIDAQABAoIBAQCGj35PLupjtpXJ +j7BBBOMCn1MXRU2qN0m+IT5JmSg/NXfK/UKG5pEpZuXXF4pPIiu7rpFRzmA33kv+ +KLwbVWOIHotWjwWbHHrCfRUNpSj6aGbyyL3D174azh184/5ZBZjQHhtN+/pB3791 +y+XUgOwRcccHiil24TR/LTfAaM45yxxh/xx/0suExYTaBtadpdsPbg7x8wBk1slg +rEXOKKhcwq7fapnssJccF6//vSyBr4yOGOZmKUPpj9MSNZMD/htwGBm+dJejXKKa +jwNL0CjEVYMtIzUbSXM8nrWu8Zrw2X5+HwL5PlVcJvj5X0teNSG7hLWnZiHJbvFP +EdbOcKgBAoGBAOdN1Ymoofyz/Sl4FQNHc1KhwRBPqqbiJ11lbsH2lywdKzZnBscl +OHnp5NiySY8uV9WOXd2+EyOhP6obd9DhrsrfMaIt7m+jHSmxQi7PYIZIEr6nWjmA +CZLwAgfHRXN7Urlc0bet48wX4yrw8lz9gcjNxqGpsASotg6a/jJZ1V8vAoGBAOSk +PK+5i2U47bHkL8T9TTNqYc1gm0F5TA6qgt+CNPzU5JhYju+KLp4LXx8fmgaRLNMI +/AVb6gM17J0eqh4nuGQQQh4P3/QLQSfckfk7Xl3doePq1ppqJWyIlHQ42dF+Dyil +Z3spMnToM8XHOow5bQMmXVJsBxH6f+OkGVqjWR6RAoGAKpQJWu3P49S+JYQVWiUs +9WkRQQ9pOo8m7+pcGRhre5NjAQC2HrKbUtXbaohnQhQl1wn9/XOf0k88iPPFeo4Q +vweW+2O5IJPGKoaWyEckXZOm37GuyibnnETSGtxzzG5HLBgKAuXfqRI8nwr7kmKY +IX6/scKqxDDKUqX1ZQ9kV8ECgYBX7T0VSuJre9gVCC7Cr7KnqiqQY61xIWd5YGNR +9u3PqUN7vtrBDb/dsXvUKT//dIbrZVId8Xnt4CftSGSdkiLcAFCc5Pf4Dvfwj2dn +lEg3Cst+Lcp3uYhI08FbbJ1/bd4AgJNqDq7DvKRkU7iVQmREyNUspDSX2mCiN3I0 +pArasQKBgFHv5vHLPvGDSO/segOQxIayEy3BCtOYvJH3y/7xHj4810w9VFxSymkF +KBNOglW0MGeN0SbFfL76ucCNoDtn/k0EBBk/n1iBkf54SglDCnKIMasSH7Bj1n4k +pVN3JC+o9hu0VJ43LBsvCS1x5YXNBiUrcHbs9Z9BqOeD051mu2Cd -----END RSA PRIVATE KEY----- diff --git a/config/version.go b/config/version.go index c7148e6..473099e 100644 --- a/config/version.go +++ b/config/version.go @@ -21,7 +21,7 @@ Github:%s RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check. ` - VERSION = "22.6.30.1107 Alpha" + VERSION = "22.7.4.11.30 Alpha" TITLE = "RedGuard" LICENSE = "GPL-2.0" URL = "https://github.com/wikiZ/RedGuard" diff --git a/core/ProxyFilter.go b/core/ProxyFilter.go index 0894036..d9016fa 100644 --- a/core/ProxyFilter.go +++ b/core/ProxyFilter.go @@ -132,6 +132,7 @@ func ProxyFilterManger(req *http.Request) (status bool) { } } } + // Check the location of the requested IP address if allowLocation != "" && allowLocation != "*" { // @param allowLocation string The territory that is allowed to go online