fireprox
axiom
| fireprox | axiom | |
|---|---|---|
| 9 | 3 | |
| 1,705 | 3,823 | |
| - | - | |
| 0.0 | 7.0 | |
| about 1 year ago | 7 days ago | |
| Python | Shell | |
| GNU General Public License v3.0 only | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
fireprox
- ustayready/fireprox: AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation
-
How do real hunters handle with rate-limit?
- Bypass it with IP rotation. In most cases that works. There are things like AWS API gateway that can be useful for this through fireprox. There is also axiom or hakscale
-
Burp and poxy list?
This would be a good job for an AWS API Gateway. Setup the API gateway using FireProx, then browse to the FireProx URL and intercept with Burp. No special configuration in Burp is needed; AWS will rotate in a different IP for each connection request.
-
Write up for the API secure programming challenge that was inspired by the major security incident happened to second largest telco in Australia
Rate limiting is only by source IP address? But attackers have tools that rotate IP address, and they can launch thousands of attacks in parallel from different IP addresses. Surely we can do better than that?
-
IPv4 Turf War
Had some fun with this. I used fireprox[0] to grab a ton of AWS IPs, and some proxy vendors for some other random ranges. Sadly my ASN has only /24s in disparate ranges so it wouldn’t make a dent for most of them.
[0] https://github.com/ustayready/fireprox
-
Ways to exploit my system
basically unlimited pool of IP addresses from PaaS providers that can be rotated quickly with a script like https://github.com/ustayready/fireprox
-
How does reconnaissance work in real life?
routing traffic through cloud providers using tools like https://github.com/ustayready/fireprox
- TikTokers flood Texas abortion whistleblower site with Shrek memes, fake reports and porn
-
Created a Python library to bypass IP-based rate limiting: python-requests-rotator :)
- Using ustayready's fireprox server, which will proxy things over
axiom
-
How do real hunters handle with rate-limit?
- Bypass it with IP rotation. In most cases that works. There are things like AWS API gateway that can be useful for this through fireprox. There is also axiom or hakscale
-
Axiom: Just-in-time dynamic infra for offensive security operations
https://github.com/pry0cc/axiom/blob/master/interact/axiom-c...
They also recommend only installing it in an "VPS environment"(Virtual Private Serer) because it overwrites your .bashrc or .zshrc files depending on your preferred Shell.
-
Help finding tools
Hello, I was wondering if anyone can help me find any tools like https://github.com/pry0cc/axiom that do the same, spin up a bunch of vms and have an nmap scan from source?
What are some alternatives?
requests-ip-rotator - A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.
fricas - Official repository of the FriCAS computer algebra system
IPRotate_Burp_Extension - Extension for Burp Suite which uses AWS API Gateway to rotate your IP on every request.
ffmpeg_batch - FFmpeg Batch AV Converter
plwbbot
reconftw - reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
hakscale - Distribute ordinary bash commands over many systems
AV-converter - A web app to convert an audio/video file to another format. Client side conversion means that your file does not get uploaded to a server. You can also download YouTube videos at the /yt endpoint.
stylegan2-pytorch - Simplest working implementation of Stylegan2, state of the art generative adversarial network, in Pytorch. Enabling everyone to experience disentanglement
kenzer - automated web assets enumeration & scanning [DEPRECATED]
Sudomy - Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting
NotEnoughAV1Encodes - GUI for AV1 (aomenc, rav1e & svt-av1)