BounceBack - ↕️🤫 Stealth redirector for your red team operation

项目说明

BounceBack

![Go Report Card]()
![Tests]()
![CodeQL]()
![Docs]()

↕️🤫 Stealth redirector for your red team operation security.

!Atchitecture

O

BounceBack is a powerful, highly customizable and configurable reverse proxy with WAF functionality for hiding your C2/phishing/etc infrastructure from blue teams, sandboxes, scanners, etc. It uses real-time traffic analysis through filters and their combinations to hide your tools from illegitimate .

The tool is distributed with preconfigured lists of blocked words, blocked and allowed IP addresses.

For more information on tool usage, you may visit project's wiki.

Features

* Highly configurable and customizable filters pipeline with boolean-based concatenation of rules will be able to hide your infrastructure from the most keen blue eyes.
* Easily extendable project structure, e can add rules for their own C2.
* Integrated and curated massi of IPv4 pools and ranges known to be associated with IT Security combined with IP filter to disallow them to use/attack your infrastructure.
* Malleable C2 Profile parser is able to inbound HTTP(s) traffic against the Malleable's config and reject in packets.
* Out of the box domain fronting support allows you to hide your infrastructure a little bit more.
* Ability to check the IPv4 address of request against IP Geolocation/reverse lookup data and compare it to specified regular expressions to exclude out peers connecting outside allowed companies, nations, cities, domains, etc.
* All incoming requests may be allowed/disallowed for any time period, so you may configure work time filters.
* Support for multiple proxies with different filter pipelines at one BounceBack instance.
* logging mechanism allows you to keep track of all incoming requests and events for analyzing blue team behaviour and debug issues.

Rules

The main idea of rules is how BounceBack matches traffic. The tool currently supports the following rule types:

* Boolean-based (and, or, not) rules combinations
* IP and subnet analysis
* IP geolocation fields inspection
* Reverse lookup domain probe
* Raw packet regexp matching
* Malleable C2 profiles traffic
* Work (or not) hours rule

Custom rules may be easily added, just register your RuleBaseCreator or RuleWrapperCreator. See already created RuleBaseCreators and RuleWrapperCreators

Rules configuration page may be found here.

Proxies

The proxies section is used to configure where to listen and proxy traffic, which protocol to use and how to chain rules together for traffic filtering. At the moment, BounceBack supports the following protocols:

* HTTP(s) for your web infrastructure
* DNS for your DNS tunnels
* Raw TCP (with or without tls) and UDP for custom protocols

Custom protocols may be easily added, just register your new type in manager. Example proxy realizations may be found here.

Proxies configuration page may be found here.

Installation

Just download latest release from release page, unzip it, edit config file and go on.

If you want to build it from source, clone it (don't forget about GitLFS), install goreleaser and run:

Usage

1. (Optionally) Update banned_ips.txt list:

2. Modify config.yml for your needs. Configure rules to match traffic, proxies to analyze traffic using rules and globals for deep rules configuration.

3. Run BounceBack:

> Usage of BounceBack: \
> -c, --config string Path to the config file in YAML format (default "config.yml") \
> -l, --log string Path to the log file (default "bounceback.log") \
> - count logging (0 = info, 1 = debug, 2+ = trace)

项目信息

开发语言：Go

Star 数：1115

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕↕️🤫 Stealth redirector for your red team operation security展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。