{"id":13842257,"url":"https://github.com/Li4n0/revsuit","last_synced_at":"2025-07-11T14:31:46.076Z","repository":{"id":43032338,"uuid":"360130562","full_name":"Li4n0/revsuit","owner":"Li4n0","description":"RevSuit is a flexible and powerful reverse connection platform designed for receiving connection from target host in penetration. ","archived":false,"fork":false,"pushed_at":"2023-06-01T16:38:00.000Z","size":18061,"stargazers_count":518,"open_issues_count":0,"forks_count":62,"subscribers_count":10,"default_branch":"master","last_synced_at":"2024-11-21T12:45:11.151Z","etag":null,"topics":["bug-bounty","dnslog","oob","out-of-band","pentest-tool","rce","reverse-connection","ssrf","xxe"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Li4n0.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-04-21T10:39:44.000Z","updated_at":"2024-11-13T09:54:14.000Z","dependencies_parsed_at":"2024-06-18T21:01:27.712Z","dependency_job_id":null,"html_url":"https://github.com/Li4n0/revsuit","commit_stats":null,"previous_names":[],"tags_count":21,"template":false,"template_full_name":null,"purl":"pkg:github/Li4n0/revsuit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Li4n0%2Frevsuit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Li4n0%2Frevsuit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Li4n0%2Frevsuit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Li4n0%2Frevsuit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Li4n0","download_url":"https://codeload.github.com/Li4n0/revsuit/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Li4n0%2Frevsuit/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264833275,"owners_count":23670617,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bug-bounty","dnslog","oob","out-of-band","pentest-tool","rce","reverse-connection","ssrf","xxe"],"created_at":"2024-08-04T17:01:30.467Z","updated_at":"2025-07-11T14:31:41.969Z","avatar_url":"https://github.com/Li4n0.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# RevSuit - A Flexible and Powerful Reverse Connection Platform\n\nEnglish ｜[简体中文](./README.zh-CN.md)\n\n## Overview\n\nRevSuit is a flexible and powerful reverse connection platform designed for receiving connection from target host in\npenetration. It currently supports HTTP, DNS, RMI, LDAP, MySQL and FTP protocols.\n\nFlexible:\n\n1. RevSuit can set flexible rules to capture different connections.\n2. Deploy and run via binaries without worrying about nasty dependency errors.\n\nPowerful:\n\n1. Allows to customize the response for different connections through rules and supports dynamic response generation\n   using template variables.\n2. Support a variety of protocols, and support the in-depth utilization of some protocols, such as DNS rebinding, MySQL\n   Load Local Data, JDBC Deserialize Exploit, FTP Passive Mode SSRF, etc.\n3. Native support for use with scanners.\n4. Support push notifications to popular office software.\n5. Other thoughtful and detailed features.\n\n## Basic Usage\n\n### Installation and Configuration\n\nDownload the latest release directly or build by following steps:\n\n```bash\ngit clone https://github.com/Li4n0/revsuit.git\ncd revsuit/frontend \u0026\u0026 yarn install \u0026\u0026 yarn build\ncd ../ \u0026\u0026 go build ./cmd/revsuit/revsuit.go\n```\n\nRevSuit will generate default configuration file on first run. Modify the configuration file according to your needs,\nthen re-run. A detailed description of the configuration file can be found at: [Configuration Notes](./CONFIG.md)\n\n### Run\n\nIn order to confirm the IP location, it needs to use the IP location database. `QQwry` is used as the data source by\ndefault, you can also modify the configuration to use `GeoIP`. If the selected database is not available in the current\ndirectory or the database is updated for more than a week, RevSuit will automatically download the latest database. If\nthe download fails, the `IpArea` field will always be null.\n\n```bash\n$ ./revsuit   \n2021/05/16 22:55:10 [ INFO] Downloading qqwry.dat...\n\n    ____            _____       _ __ \n   / __ \\___ _   __/ ___/__  __(_) /_\n  / /_/ / _ \\ | / /\\__ \\/ / / / / __/\n / _, _/  __/ |/ /___/ / /_/ / / /_  \n/_/ |_|\\___/|___//____/\\__,_/_/\\__/    \n                                   vBeta0.1\n     https://revsuit.pro\n2021/05/16 22:55:22 [ INFO] Starting HTTP Server at :80, token:your_token\n2021/05/16 22:55:22 [ INFO] Start to listen FTP PASV port at :2020, PasvIP is 10.9.8.7\n2021/05/16 22:55:22 [ INFO] Starting FTP Server at :21\n2021/05/16 22:55:22 [ INFO] Starting MySQL Server at :3306\n2021/05/16 22:55:22 [ INFO] Starting RMI Server at :1099\n2021/05/16 22:55:22 [ INFO] Starting DNS Server at :53\n```\n\nAfter running, you can visit the `/revsuit/admin/` path of HTTP Server and enter the token to access the control panel.\n\n### Create Rules and Receive Connection\n\nTake the creation of HTTP rules as an example:\n\nA few notes are as follows：\n\n1. The `name` and `flagFormat` of rule are unique.\n2. `FlagFormat` uses regular expression syntax, and for different protocols, the fields matched by flagFormat are\n   different, you can check the corresponding hints to get details when creating rules.\n3. Rules with high rank will take effect first.\n4. For different protocol rules, you can make different custom responses, and for some protocols, template variables can\n   be used.\n5. You can set the named grouping of regular expressions in `flagFormat`, and the result of the matching grouping will\n   also be used as a template variable.\n\nAs shown below, we create a rule that uses the built-in template variables and custom template variables of the http\nprotocol, and names it `test_create_rule`:\n\n![img.png](./images/create_rule.png)\n\nThen make a request that satisfies the rule and view the response.\n\n![img.png](./images/do_request.png)\n\nThe request will be logged on the platform at the same time.\n\n![img.png](./images/http_log.png)\n\n### Notice\n\nIf you want to be notified of new connections on your office software, you can configure the webhook address of the\nrelevant software in the configuration file and turn on the `Notice` switch for the corresponding rule. Only support to\nfour software types currently: dingtalk,wechat,lark,slack.(Discord and telegram support is in the plan.)\n\n### Import/Export Rules\n\nIf you're migrating platforms or purging data, it can be a hassle to recreate rules. That's why the platform supports\nimport and export of rules.\n\nThe entry point for this function is located at `Settings\u003eRULES`.\n\nThe rules are stored in yaml format for import and export, like the following:\n\n```yaml\nhttp:\n  - name: test_create_rule\n    flag_format: (?P\u003cwhat\u003e\\w+)\\?\n    rank: 0\n    push_to_client: false\n    notice: false\n    response_status_code: \"302\"\n    response_headers:\n      Location: ${query.url}\n    response_body: ${header.say} ${what}\n  - name: other_rule\n    flag_format: other\n    rank: 1\n    push_to_client: false\n    notice: true\n    response_status_code: \"200\"\n    response_headers: { }\n    response_body: Hello Revsuit!\ndns:\n  ... ...\n```\n\n## Advance Usage\n\n### Use with Scanner\n\nRevSuit was split from my scanner project, so its native support works with scanners.\n\nFrom RevSuit's perspective, we call a scanner a client.\n\n#### Establish connection\n\nRevSuit\nuses [HTTP Server-sent Events](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events)\n(SSE) to establish a one-way communication channel with the client.\n\nThe API for the channel is: `/revsuit/api/events?message` .The client first needs to add the `Token: your token` header\nto the Header, and then access the API to establish the channel. When the platform receives a new connection, the `flag`\ncaptured by the rule will be passed to the client through this channel.\n![img.png](./images/sse.gif)\n\nHere is a [simple demo](https://gist.github.com/Li4n0/21aa0bec2d626114a729ca2677efb05a) using Golang's sse library as an\nexample.\n\n#### Multi-client\n\nAs shown above, RevSuit supports multiple clients, and each client **in the connected state** receives a push of `flag`,\nso distributed scanning can be supported.\n\nIf you don't want every client to receive all `flag` pushes, you can use the `Flag-Filter` request header when creating an sse connection to set the format(regular expressions) of the `flag` you want that client to receive:\n\n![img.png](./images/flag-filter.gif)\n\n\n#### Temporary storage queue\n\nRevSuit will store `flag` temporarily in the queue when there is no client connection and send it when the client\nconnects, so you don't have to worry about missing the vulnerability because the client disconnects. (This is especially\nhelpful for discovering delay-triggered vulnerabilities.)\n\n#### Use flagGroup\n\nIn a real-world vulnerability scanning scenario, you may send a large number of different payloads for a single\nvulnerability point, and they may all be valid, which can result in the backlink platform receiving many requests, yet\nthey are caused by the same vulnerability. If you don't want the client to receive so many `flags` for the same\nvulnerability, you can take advantage of the `flagGroup` feature of rule's flagFormat.\n\n`FlagGroup` is the content matched by the anonymous group in the `flagFormat` field of the rule. The platform will check\nthe content matched in the grouping,and the flag is only pushed to the client when then content(`flagGroup`) captured\nfor the first time.\n\nFor example, SSRF scanning.\n\nFirstly create a rule like the following:\n\n```yaml\nhttp:\n  - name: ssrf\n    flag_format: (ssrf[a-z0-9]{6})[0-9]{1,3}\n    rank: 0\n    push_to_client: false\n    notice: false\n    response_status_code: \"200\"\n    response_headers: { }\n    response_body: \"Here is a SSRF!\"\n```\n\nSuppose our target is `https://www.testvuln.com?url=api.com\u0026p=useless`, and for SSRF we have 5 payloads. The final\nrequest sent by the scanner may\nbe `['https://www.testvuln.com?url=http://revsuit.com/ssrfa98oni1\u0026p=useless','https://www.testvuln.com?url=http://revsuit.com/ssrfa98oni2\u0026p=useless', ... ,'https://www.testvuln.com?url=//revsuit.com/ssrfa98oni5\u0026p=useless`']\n. They may all attack successfully.\n\nHowever, because anonymous grouping is used in the rule's `flagFormat`, The platform will query the\nconnected `flagGroup`, in this case `ssrfa98oni`, and push `flag` to the client only at its first appearance, so the\nclient will only receive one flag:`ssrfa98oni1`. It already proves that the `url` parameter of the target is vulnerable.\n\n### Multi-module collocation\n\nIn actual penetration testing scenarios, certain tasks can be done easily and quickly by combining and matching various\nmodules of RevSuit. The following is an example of a blind XXE in Java Web, showing how to use RevSuit's HTTP and FTP\nmodules, combined with template variables, to quickly complete a port scan.\n\nFirst create an HTTP rule to return evil.dtd, customize the response to the contents of dtd so that it goes to connect\nto RevSuit's FTP service, and use template variables to pass the Host and Port to be scanned to FTP via FTP's user and\npassword.\n\n![create evil.dtd rule](./images/evil_dtd_rule.png)\n\nThen create an FTP rule that receives the Host and port to be scanned from the user and password template variables, set\nto Pasv Address.\n\n![create ftp scan rule](./images/ftp_scan_rule.png)\n\nThen use BurpSuit to launch the scan, by setting the host and port parameters in the evil.dtd URL to set the target of\nthe port scan.\n\n![xxe](./images/xxe.png)\n\nThe running effect is as follows:\n\n![ftp-scan](images/ftp_scan.gif)\n\nIt because the FTP connection will be crashed if `Passive Address` is not accessible, we can determine whether the port\nis open or not based on whether the connection exits normally.For this example, we successfully detected that port 8005\nand 8080 are open.\n\n## More Usage\n\nA more detailed wiki is being prepared, you can explore by yourself before it.\n\n## Feedback, Suggestions and Communication\n\nSubmit an issue or contact me through Weixin: `TGk0bjA2Cg==`\n\n## Acknowledgements\n\n### Reference\n\nThis project draws on the code of the following outstanding projects:\n\n* [https://github.com/rmb122/rogue_mysql_server](https://github.com/rmb122/rogue_mysql_server)\n* [https://github.com/256dpi/newdns](https://github.com/256dpi/newdns)\n* [https://github.com/EmYiQing/JNDIScan](https://github.com/EmYiQing/JNDIScan)\n\n### Specifically\n\nThanks to my friend [@E99p1ant](https://github.com/wuhan005/) for all the help and advice I received during the\ndevelopment of this project.\n\n## License\n\n@Apache License 2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FLi4n0%2Frevsuit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FLi4n0%2Frevsuit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FLi4n0%2Frevsuit/lists"}