IPRotate_Burp_Extension
fireprox
IPRotate_Burp_Extension | fireprox | |
---|---|---|
2 | 9 | |
768 | 1,705 | |
1.4% | - | |
5.8 | 0.0 | |
3 months ago | about 1 year ago | |
Python | Python | |
- | GNU General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
IPRotate_Burp_Extension
-
Let's Talk About Two-Factor Auth
I rank Yubikey #1 because it is the easiest item to keep safe without sacrificing usability. Most people do not carry their Yubikey around with them everywhere so it can stay protected in your home. TOTP on the other hand is only as hardened as your cell phone is if it gets stolen from you. I once had a friend who knew I was a "hacker" ask me to hack her phone and she handed it to me. I assumed I'd open it, attempt to guess her pin and hand it back as we were eating dinner and I don't carry my laptop everywhere, but she didn't even have a lock on her phone. I went to her also unprotected Venmo app and showed her how easy it would be to send myself money. Now this was years ago and I'd say most people are smart enough to lock their devices but not all methods of device locking are created equal either so know that if you do choose to use TOTP it is only as secure as your phone is. Additionally, most TOTP codes are short (6 digits) whereas Yubikey's code is fairly verbose. If the application does not implement rate limiting in theory a savvy attacker could brute force TOTP. An application that only rate limits by IP could be beaten by someone using a tool like this: https://github.com/RhinoSecurityLabs/IPRotate_Burp_Extension.
-
Created a Python library to bypass IP-based rate limiting: python-requests-rotator :)
- Setting up RhinoSecurity's IPRotate Burp extension and then using Burp as your upstream proxy
fireprox
- ustayready/fireprox: AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation
-
How do real hunters handle with rate-limit?
- Bypass it with IP rotation. In most cases that works. There are things like AWS API gateway that can be useful for this through fireprox. There is also axiom or hakscale
-
Burp and poxy list?
This would be a good job for an AWS API Gateway. Setup the API gateway using FireProx, then browse to the FireProx URL and intercept with Burp. No special configuration in Burp is needed; AWS will rotate in a different IP for each connection request.
-
Write up for the API secure programming challenge that was inspired by the major security incident happened to second largest telco in Australia
Rate limiting is only by source IP address? But attackers have tools that rotate IP address, and they can launch thousands of attacks in parallel from different IP addresses. Surely we can do better than that?
-
IPv4 Turf War
Had some fun with this. I used fireprox[0] to grab a ton of AWS IPs, and some proxy vendors for some other random ranges. Sadly my ASN has only /24s in disparate ranges so it wouldn’t make a dent for most of them.
[0] https://github.com/ustayready/fireprox
-
Ways to exploit my system
basically unlimited pool of IP addresses from PaaS providers that can be rotated quickly with a script like https://github.com/ustayready/fireprox
-
How does reconnaissance work in real life?
routing traffic through cloud providers using tools like https://github.com/ustayready/fireprox
- TikTokers flood Texas abortion whistleblower site with Shrek memes, fake reports and porn
-
Created a Python library to bypass IP-based rate limiting: python-requests-rotator :)
- Using ustayready's fireprox server, which will proxy things over
What are some alternatives?
Osintgram - Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
requests-ip-rotator - A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.
plwbbot
PayloadsAllTheThings - A list of useful payloads and bypass for Web Application Security and Pentest/CTF
hakscale - Distribute ordinary bash commands over many systems
dirsearch - Web path scanner
axiom - The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
burp-copy-as-ffuf - Burp Extension that copies a request and builds a FFUF skeleton
stylegan2-pytorch - Simplest working implementation of Stylegan2, state of the art generative adversarial network, in Pytorch. Enabling everyone to experience disentanglement
HackBar - HackBar plugin for Burpsuite
osmedeus - A Workflow Engine for Offensive Security