{"id":13510255,"url":"https://github.com/kgretzky/pwndrop","last_synced_at":"2025-05-14T08:06:13.480Z","repository":{"id":38789103,"uuid":"224714134","full_name":"kgretzky/pwndrop","owner":"kgretzky","description":"Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.","archived":false,"fork":false,"pushed_at":"2023-02-25T05:08:15.000Z","size":7826,"stargazers_count":2121,"open_issues_count":44,"forks_count":267,"subscribers_count":45,"default_branch":"master","last_synced_at":"2025-04-11T02:51:55.651Z","etag":null,"topics":["file-manager","file-sharing","http-server","payloads","redteam","self-hosted","webdav-server"],"latest_commit_sha":null,"homepage":"https://breakdev.org/pwndrop","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kgretzky.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null},"funding":{"github":null,"patreon":"mrgretzky","open_collective":null,"ko_fi":"mrgretzky","tidelift":null,"community_bridge":null,"liberapay":"mrgretzky","issuehunt":null,"otechie":null,"custom":null}},"created_at":"2019-11-28T19:06:30.000Z","updated_at":"2025-04-10T15:14:25.000Z","dependencies_parsed_at":"2024-01-07T11:00:32.167Z","dependency_job_id":"1b07fbec-98ef-4cf9-bbcd-1eebd0e302c4","html_url":"https://github.com/kgretzky/pwndrop","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kgretzky%2Fpwndrop","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kgretzky%2Fpwndrop/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kgretzky%2Fpwndrop/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kgretzky%2Fpwndrop/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kgretzky","download_url":"https://codeload.github.com/kgretzky/pwndrop/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254101615,"owners_count":22014909,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["file-manager","file-sharing","http-server","payloads","redteam","self-hosted","webdav-server"],"created_at":"2024-08-01T02:01:30.763Z","updated_at":"2025-05-14T08:06:08.472Z","avatar_url":"https://github.com/kgretzky.png","language":"JavaScript","funding_links":["https://patreon.com/mrgretzky","https://ko-fi.com/mrgretzky","https://liberapay.com/mrgretzky"],"categories":["JavaScript","JavaScript (485)","self-hosted","Datastores"],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg alt=\"pwndrop logo\" src=\"https://raw.githubusercontent.com/kgretzky/pwndrop/master/media/pwndrop-logo-512.png\" height=\"120\" /\u003e\n  \u003cp align=\"center\"\u003e\n    \u003cimg alt=\"pwndrop title\" src=\"https://raw.githubusercontent.com/kgretzky/pwndrop/master/media/pwndrop-title-black-512.png\" height=\"40\" /\u003e\n  \u003c/p\u003e\n\u003c/p\u003e\n\n**pwndrop** is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV.\n\nIf you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of `python -m SimpleHTTPServer`, **pwndrop** is definitely for you!\n\n\u003cp align=\"center\"\u003e\n  \u003cimg alt=\"demo\" src=\"https://raw.githubusercontent.com/kgretzky/pwndrop/master/media/demo1.gif\" height=\"500\" /\u003e\n\u003c/p\u003e\n\nWith **pwndrop** you can:\n- [x] Upload and immediately share multiple files using your own private VPS, using drag \u0026 drop.\n- [x] Decide to make files available or unavailable for download with a single click.\n- [x] Set up custom download URLs, for shared files, without playing with directory structure.\n- [x] Set up facade files, which will be served instead of the original file whenever you feel like it.\n- [x] Set up automatic redirects to spoof the file's extension in a shared link.\n- [x] Change MIME type of the served file to change browser's behavior when a download link is clicked.\n- [x] Serve files over HTTP, HTTPS and WebDAV.\n- [x] Install and setup everything using a bash oneliner.\n- [x] Set up **pwndrop** to work as a nameserver and respond with a valid DNS A record to any sub-domain you choose.\n- [x] Protect your admin panel behind a custom secret URL path and log in securely with your own username and password.\n- [x] Never worry about setting up HTTPS certificates as **pwndrop** does everything for you in the background (including auto-renewals).\n\nIts main goal is to make file sharing as easy and intuitive as possible, while implementing extra features to aid in red team assessments.\n\nFrontend of **pwndrop** is developed in pure Vue.js + Bootstrap with no npm or webpack dependencies. The backend serves REST API and manages a local database, powered by GO language.\n\n## Write-up\n\nIf you want to learn how to use **pwndrop** or you want to learn what new features were implemented in recent releases, make sure to check out the posts on my blog:\n\nhttps://breakdev.org/pwndrop\n\n## Video guide\n\nTake a look at the fantastic video made by Luke Turvey ([@TurvSec](https://twitter.com/TurvSec)), which fully explains how to get started using **pwndrop**.\n\n[![File and Phishing Payload Hosting using PwnDrop (Red Team) - Luke Turvey](https://img.youtube.com/vi/e3veSyIFvOE/0.jpg)](https://www.youtube.com/watch?v=e3veSyIFvOE)\n\n## Prerequisites\n\nIf you don't yet have the server to deploy to I highly recommend Digital Ocean. The cheapest $5/mo Debian 9 server with 25GB of storage space will work wonders for you. You can use my referral link to [get an extra $100 to spend on your servers in 60 days for free](https://m.do.co/c/50338abc7ffe).\n\nRegister a new domain and point its DNS A records to your VPS IP. You can also register a domain and point its `ns1` and `ns2` nameservers to **pwndrop** instance IP - it will automatically respond with valid DNS A replies.\n\n1. Registered domain name pointing to **pwndrop** instance IP as a DNS A records or as a nameserver.\n2. Server with at least 512 MB RAM.\n\nIf you want to set up **pwndrop** without a domain, check below how to set up a local instance, which will not auto-generate HTTPS certificates.\n\n## Installation\n\nMake sure there aren't any DNS or HTTP(S) servers running before you attempt to install **pwndrop**.\n\n#### Oneliner\n\nI do not recommend running oneliners, before downloading and checking the script code, but if you are really in a hurry, here it is:\n```\ncurl https://raw.githubusercontent.com/kgretzky/pwndrop/master/install_linux.sh | sudo bash\n```\n\nThis will download the latest amd64 release binary and fully install a daemon running in a background.\n\n#### From binary\n\nFirst you need to download the release package you want from: https://github.com/kgretzky/pwndrop/releases\n\nThen do the following (this performs same actions to the oneliner):\n\n```\ntar zxvf pwndrop-linux-amd64.tar.gz\n./pwndrop stop\n./pwndrop install\n./pwndrop start\n./pwndrop status\n```\n\n#### From source code\n\nFirst of all, make sure you have installed GO with version at least **1.13**: https://golang.org/doc/install\n\nThen do the following:\n\n```\nsudo apt-get -y install git make\ngit clone https://github.com/kgretzky/pwndrop\ncd pwndrop\nmake\nmake install\n```\n\n## Quickstart\n\nMake sure the **pwndrop** is running.\n\n1. Open the secret URL to authorize your browser: `https://yourdomain.com/pwndrop` (this is a default value; make sure to use the secret path, you've pre-configured)\n2. Open the admin panel URL in your browser: `https://yourdomain.com/` (since you've authorized your browser, you will now see an admin panel login page)\n3. Create your admin account or login.\n4. Click the configuration cog in top-left corner and make sure you change the secret path to something other than `/pwndrop`.\n\nYou're good to go!\n\n## Running from CLI\n\nYou don't have to install **pwndrop** as a daemon and you can run it straight from the console.\n\n```\nusage: pwndrop [start|stop|install|remove|status] [-config \u003cconfig_path\u003e] [-debug] [-no-autocert] [-no-dns] [-h]\n\ndaemon management:\n    start           : start the daemon\n    stop            : stop the daemon\n    install         : install the daemon using the available system manager (systemd, systemv and upstart supported)\n    remove          : uninstall the daemon\n    status          : check status of the installed daemon\n\nparameters:\n    -config         : specify a custom path to a config file (def. 'pwndrop.ini' in same directory as the executable)\n    -debug          : enable debug output \n    -no-autocert    : disable automatic TLS certificate retrieval from LetsEncrypt; useful when you want to connect over IP or/and in a local network\n    -no-dns         : do not run a DNS server on port 53 UDP; use this if you don't want to use pwndrop as a nameserver\n    -h              : usage help\n```\n\n## Configuration\n\nOn first launch, **pwndrop**, by default, will create a new configuration file `pwndrop.ini` in the same directory as an executable. You can later modify it or supply your own, for example to pre-configure **pwndrop** before the installation to automate the deployment of a tool even better.\n\nHere is an example config file with all available config variables with commentary:\n```\n[pwndrop]\nlisten_ip = \"190.33.86.22\"                  # the external IP of your pwndrop instance (must be set if you want to use the nameserver feature)\nhttp_port = 80                              # listening port for HTTP and WebDAV\nhttps_port = 443                            # listening port for HTTPS\ndata_dir = \"./data\"                         # directory path where data storage will reside (relative paths are from executable directory path)\nadmin_dir = \"./admin\"                       # directory path where the admin panel files reside (relative paths are from executable directory path)\n\n[setup]                                     # optional: put in if you want to pre-configure pwndrop (section will be deleted from the config file on first run)\nusername = \"admin\"                          # username of the admin account\npassword = \"secretpassword\"                 # password of the admin account\nredirect_url = \"https://www.somedomain.com\" # URL to which visitors will be redirected to if they supply a path, which doesn't point to any shared file (put blank if you want to return 404)\nsecret_path = \"/pwndrop\"                    # secret URL path, which upon visiting will allow your browser to access the login page of the admin panel (make sure to change the default value)\n```\n\nIf you want to pre-configure your **pwndrop** instance before deployment using any of the installation scripts, put your configuration file at `/usr/local/pwndrop/pwndrop.ini` and it will be parsed the moment **pwndrop** daemon is first executed.\n\n## Credits\n\nHuge thanks to [**@jaredhaight**](https://twitter.com/jaredhaight) for inspiring me to learn Vue, with his [Faction C2](https://www.factionc2.com/) framework!\n\nAlso much thanks to all the people who gave me pre-release feedback and supported me with their opinions on the tool!\n\n## License\n\n**pwndrop** is made by Kuba Gretzky ([@mrgretzky](https://twitter.com/mrgretzky)) and it's released under GPL3 license.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkgretzky%2Fpwndrop","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkgretzky%2Fpwndrop","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkgretzky%2Fpwndrop/lists"}