pwndrop - Self-deployable file hosting service for red teame

项目说明

<p align="center">
<img alt="pwndrop logo" src=" height="120" />
<p align="center">
<img alt="pwndrop title" src=" height="40" />
</p>
</p>

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.

If you've e to quickly set up an nginx/apache web 服务端 to host your files and you were ne with the limitations of python -m SimpleHTTPServer, pwndrop is definitely for you!

<p align="center">
<img alt="demo" src=" height="500" />
</p>

With pwndrop you can:

Its main goal is to make file sharing as easy and intuitive as possible, while implementing extra features to aid in red team assessments.

Frontend of pwndrop is de in pure Vue.js + Bootstrap with no npm or webpack dependencies. The backend serves REST API and manages a local 数据库, powered by GO language.

Write-up

If you want to learn how to use pwndrop or you want to learn what new features were implemented in recent releases, make sure to check out the posts on my blog:

Video guide

Take a look at the fantastic video made by Luke Turvey (), which fully explains how to get started using pwndrop.

![File and Phishing Payload Hosting using PwnDrop (Red Team) - Luke Turvey]()

Prerequisites

If you don't yet have the 服务端 to deploy to I highly recommend Digital Ocean. The cheapest $5/mo Debian 9 服务端 with 25GB of storage space will work wonders for you. You can use my referral link to get an extra $100 to spend on your servers in 60 days for free.

Register a new domain and point its DNS A records to your VPS IP. You can also register a domain and point its ns1 and ns2 nameservers to pwndrop instance IP - it will automatically respond with valid DNS A replies.

1. Registered domain name pointing to pwndrop instance IP as a DNS A records or as a nameserver.
2. Server with at least 512 MB RAM.

If you want to set up pwndrop without a domain, check below how to set up a local instance, which will not auto-generate HTTPS certificates.

Installation

Make sure there aren't any DNS or HTTP(S) servers running before you attempt to install pwndrop.

#### Oneliner

I do not recommend running oneliners, before downloading and checking the script 代码, but if you are really in a hurry, here it is:

This will download the latest amd64 release binary and fully install a daemon running in a background.

#### From binary

First you need to download the release package you want from:

Then do the following (this performs same actions to the oneliner):

#### From source code

First of all, make sure you ha GO with at least 1.13:

Then do the following:

Quickstart

Make sure the pwndrop is running.

1. Open the secret URL to authorize your browser: (this is a default value; make sure to use the secret path, you')
2. Open the admin panel URL in your browser: (since you' your browser, you will now see an admin panel login page)
3. Create your admin account or login.
4. Click the configuration cog in top-left corner and make sure you change the secret path to something other than /pwndrop.

You're good to go!

Running from CLI

You don't have to install pwndrop as a daemon and you can run it straight from the console.

Configuration

On first launch, pwndrop, by default, will create a new configuration file pwndrop.ini in the same directory as an executable. You can later modify it or supply your own, for example to pre-configure pwndrop before the installation to automate the deployment of a 工具 e.

Here is an example config file with all a config with commentary:

If you want to pre-configure your pwndrop instance before deployment using any of the installation scripts, put your configuration file at /usr/local/pwndrop/pwndrop.ini and it will be parsed the moment pwndrop daemon is first executed.

Credits

Huge thanks to for inspiring me to learn Vue, with his Faction C2 框架!

Also much thanks to all the people who gave me pre-release feedback and supported me with their opinions on the 工具!

License

pwndrop is made by Kuba Gretzky () and it's released under GPL3 license.

项目信息

开发语言：Ja

Star 数：2276

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。