Optimized the problem of requesting regional restriction matching errors

CHANGELOG

@@ -1,3 +1,7 @@
+## [24.06.18.2001] - 2024-06-18
+### Update
+- Optimized the problem of requesting regional restriction matching errors
+
 ## [23.08.21.0113] - 2023-08-21
 ### Added
 - Custom Delete Response Fields

README.md

@@ -300,7 +300,7 @@ The profile written by 风起 is recommended to use:
 
 ## Custom Delete Response Fields
 
-In Cobalt Strike 4.7+, Teamserver automatically removes the Content-Encoding header without any notification, potentially causing a malleable http-(get|post).server violation. For example, there is no Content-type in the CS Server response packet, but after being forwarded by RedGuard, the Content-Type is added to the header of the response packet, which causes cf to cache the page, causing interference.
+In Cobalt Strike 4.7+, Teamserver automatically removes the Content-Encoding header without any notification, potentially causing a malleable http-(get|post).server violation. Moreover, if there is no Content-type in the CS Server response message, but after being forwarded by RedGuard, the Content-Type is added to the response message header, causing cf to cache the page and causing interference.
 
 After RedGuard 23.08.21, the function of customizing the header of the response packet has been added. Users can customize and delete the header information in the response packet by modifying the configuration file to solve the problem of incorrect parsing.
 
@@ -456,6 +456,7 @@ Thank you for your support. RedGuard will continue to improve and update it. I h
 > <https://isc.n.cn/m/pages/live/index?channel_id=iscyY043&ncode=UR6KZ&room_id=1981905&server_id=785016&tab_id=253>
 > 
 > Exchange C2 traffic based on boundary node links
+> 
 > <https://www.anquanke.com/post/id/278140>
 >
 > Analysis of cloud sandbox flow identification technology
@@ -465,6 +466,10 @@ Thank you for your support. RedGuard will continue to improve and update it. I h
 > Realization of JARM Fingerprint Randomization Technology
 >
 > <https://www.anquanke.com/post/id/276546>
+>
+> C2 Infrastructure Threat Intelligence Countermeasures
+>
+> <https://paper.seebug.org/3022/>
 
 **Kunyu: <https://github.com/knownsec/Kunyu>**
 

core/ipLookUpHelper.go

@@ -1,92 +1,94 @@
-/**
- * @Author 风起
- * @contact: onlyzaliks@gmail.com
- * @File: ipLookUp.go
- * @Time: 2022/5/5 9:13
- **/
-
-package core
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"regexp"
-	"strings"
-
-	"RedGuard/lib"
-
-	"github.com/tidwall/gjson"
-)
-
-// IPLookup IP origin,API is defined to extract relevant information
-type ipLookup struct {
-	allowStatus int    // API http request status code
-	hasCount    int    // Check if the first character of location is in English
-	body        string // Get THE API response body JSON data
-	Tag         string // The json data Tag
-	location    string // Restrict the geographical location of the online
-}
-
-var (
-	_apiUrl = []string{
-		// Chinese Users IP API
-		"https://sp0.baidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php?query=%s&co=&resource_id=6006",
-		// IP API for users in other countries
-		"https://ipapi.co/%s/json/",
-	}
-	logger = lib.Logger() // logger output model
-)
-
-// IPLookUp returns true if Check whether the IP address is the same as the owning place
-// @param	ip	  		  string	Specify IP address
-// @param	location	  string	Specify location
-// NOTE: 	other countries Server You are advised to set location to English
-// This will prioritize IP API that are more efficient for you
-func IPLookUp(location, ip string) (state bool) {
-	var IPLook ipLookup
-	for _, url := range _apiUrl {
-		// Check preferentially invoked
-		if IPLook.hasCount != 1 {
-			// Check that the first character of location is in English
-			if regexp.MustCompile("[a-zA-Z]").MatchString(location[0:1]) {
-				// Other countries IP API are preferentially invoked if conditions are met
-				url, IPLook.hasCount = _apiUrl[1], 1
-			}
-		} else {
-			url = _apiUrl[0] // preferentially invoked Chinese Users IP API
-		}
-
-		// Get json data for the IP API response body
-		IPLook.allowStatus, IPLook.body = lib.HTTPRequest(fmt.Sprintf(url, ip))
-		if IPLook.allowStatus == 200 {
-			// Select the response JSON tag when json data is available
-			if url == _apiUrl[0] {
-				IPLook.Tag = `data.#.location` // Chinese Users IP API Tag
-				break
-			}
-			IPLook.Tag = `city`
-			IPLook.location += gjson.Get(IPLook.body, `region`).String()
-			break
-		}
-	}
-	// Check for valid JSON data
-	if gjson.Valid(IPLook.body) {
-		// Extracting JSON data
-		result := gjson.Get(IPLook.body, IPLook.Tag)
-		if result.Exists() {
-			for _, name := range result.Array() {
-				IPLook.location += name.String()
-			}
-			var prettyJSON bytes.Buffer
-			// Format output JSON data
-			_ = json.Indent(&prettyJSON, []byte(IPLook.body), "", "\t")
-			logger.Emergency(string(prettyJSON.Bytes()))
-			// Check whether the IP address is the same as the specified location
-			if strings.Contains(strings.ToLower(IPLook.location), strings.ToLower(location)) {
-				return true // The query result is true
-			}
-		}
-	}
-	return false
-}
+/**
+ * @Author 风起
+ * @contact: onlyzaliks@gmail.com
+ * @File: ipLookUp.go
+ * @Time: 2022/5/5 9:13
+ **/
+
+package core
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"strings"
+
+	"RedGuard/lib"
+
+	"github.com/tidwall/gjson"
+)
+
+// IPLookup IP origin,API is defined to extract relevant information
+type ipLookup struct {
+	allowStatus int    // API http request status code
+	hasCount    int    // Check if the first character of location is in English
+	body        string // Get THE API response body JSON data
+	Tag         string // The json data Tag
+	location    string // Restrict the geographical location of the online
+}
+
+var (
+	_apiUrl = []string{
+		// Chinese Users IP API
+		"https://sp0.baidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php?query=%s&co=&resource_id=6006",
+		// IP API for users in other countries
+		"https://ipapi.co/%s/json/",
+	}
+	logger = lib.Logger() // logger output model
+)
+
+// IPLookUp returns true if Check whether the IP address is the same as the owning place
+// @param	ip	  		  string	Specify IP address
+// @param	location	  string	Specify location
+// NOTE: 	other countries Server You are advised to set location to English
+// This will prioritize IP API that are more efficient for you
+func IPLookUp(location, ip string) (state bool) {
+	var IPLook ipLookup
+	for _, url := range _apiUrl {
+		// Check preferentially invoked
+		if IPLook.hasCount != 1 {
+			// Check that the first character of location is in English
+			if regexp.MustCompile("[a-zA-Z]").MatchString(location[0:1]) {
+				// Other countries IP API are preferentially invoked if conditions are met
+				url, IPLook.hasCount = _apiUrl[1], 1
+			}
+		} else {
+			url = _apiUrl[0] // preferentially invoked Chinese Users IP API
+		}
+
+		// Get json data for the IP API response body
+		IPLook.allowStatus, IPLook.body = lib.HTTPRequest(fmt.Sprintf(url, ip))
+		if IPLook.allowStatus == 200 {
+			// Select the response JSON tag when json data is available
+			if url == _apiUrl[0] {
+				IPLook.Tag = `data.#.location` // Chinese Users IP API Tag
+				break
+			}
+			IPLook.Tag = `city`
+			IPLook.location += gjson.Get(IPLook.body, `region`).String()
+			break
+		}
+	}
+	// Check for valid JSON data
+	if gjson.Valid(IPLook.body) {
+		// Extracting JSON data
+		result := gjson.Get(IPLook.body, IPLook.Tag)
+		if result.Exists() {
+			for _, name := range result.Array() {
+				IPLook.location += name.String()
+			}
+			var prettyJSON bytes.Buffer
+			// Format output JSON data
+			_ = json.Indent(&prettyJSON, []byte(IPLook.body), "", "\t")
+			logger.Emergency(string(prettyJSON.Bytes()))
+			// Check whether the IP address is the same as the specified location
+			for _, location := range strings.Split(location, ",") {
+				if strings.Contains(strings.ToLower(IPLook.location), strings.ToLower(location)) {
+					return true // The query result is true
+				}
+			}
+		}
+	}
+	return false
+}

doc/README_CN.md

@@ -299,7 +299,7 @@ MalleableFile = /root/cobaltstrike/Malleable.profile
 
 ## 自定义删除响应字段
 
-在 Cobalt Strike 4.7+ 中，Teamserver 会在没有任何通知的情况下自动删除 Content-Encoding 标头，从而可能导致违反可延展http-(get|post).server。例如CS Server响应包中没有Content-type，但经过了RedGuard转发后，在响应包Header添加了Content-Type，然后导致cf对这个页面进行了缓存，造成了干扰。
+在 Cobalt Strike 4.7+ 中，Teamserver 会在没有任何通知的情况下自动删除 Content-Encoding 标头，从而可能导致违反可延展http-(get|post).server。而且如果CS Server响应报文中没有Content-type，但经过RedGuard转发后，在响应报文头中添加了Content-Type，导致cf缓存页面，造成干扰。
 
 在RedGuard 23.08.21版本后增加了自定义响应包Header头的功能，用户可以通过修改配置文件的方式进行自定义删除的响应包中的Header信息，以解决错误解析的问题。
 
@@ -455,6 +455,7 @@ RedGuard接收到请求：
 > https://isc.n.cn/m/pages/live/index?channel_id=iscyY043&ncode=UR6KZ&room_id=1981905&server_id=785016&tab_id=253
 > 
 > 基于边界节点链路交互C2流量
+> 
 > https://www.anquanke.com/post/id/278140
 >
 > 云沙箱流量识别技术剖析
@@ -464,6 +465,10 @@ RedGuard接收到请求：
 > JARM指纹随机化技术实现
 >
 > https://www.anquanke.com/post/id/276546
+>
+> C2 基础设施威胁情报对抗策略
+>
+> https://paper.seebug.org/3022/
 
 **Kunyu: https://github.com/knownsec/Kunyu**