d00movenok / bounceback Goto Github PK

So for some reason profiles that are created with the help of the SourcePoint are getting rejected
are blocked even though the host_stage set to false

2023-11-08T13:33:01Z DBG http-get/post/stager did not match from=192.168.1.146 proxy=https_proxy rule=malleable_https_traffic
2023-11-08T13:33:01Z WRN Rejected from=192.168.1.146 proxy=https_proxy rule=malleable_https_traffic

I have multiple domains resolving to my Nginx server and I configured BounceBack to proxy to the Nginx server. But it doesn't support configuring multiple TLS certificates.

I have an error on port 80, I am using gophish already executed in tmux, any way to resolve if gophish is using it, or change the port to another?

I'm going to try changing the local port in the config

SAME ERROR

I'm sure it can but since Havoc is going through a major rewrite it might change things up. I'll do some testing today to see what I can do with it. I'll be testing out the yaotl configs for Havoc. Maybe I'll get somewhere. Who knows.

Bug:

2023-11-06T15:22:47Z DBG http-get match from=192.168.1.146 match= proxy=https_proxy rule=malleable_https_traffic
2023-11-06T15:22:47Z ERR Can't make proxy request error="Get "https://127.0.0.1:8443/test?param=aGVsbG8gd29ybGQsZnJvbSBibGFja3NudWZraW4K/test": tls: failed to verify certificate: x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs" from=192.168.1.146 proxy=https_proxy

Fix:
/BounceBack/Internals/proxy/http/proxy.go
Line 81:

	if p.TLSConfig != nil {
		p.TLSConfig.InsecureSkipVerify = true // Add this line to skip certificate verification
		p.client.Transport = &http.Transport{
			TLSClientConfig:   p.TLSConfig,
			ForceAttemptHTTP2: true,
		}
		p.server.TLSConfig = p.TLSConfig
	}

	return p, nil

coundnt parse the malleable c2 with sleep mask token set to 11, couldnt reconize some new params in new profile params. any sample profile to test with? so i can try to tweak maybe ?