{"id":19528842,"url":"https://github.com/netspi/httpillage","last_synced_at":"2025-04-26T11:33:32.802Z","repository":{"id":33315775,"uuid":"36960517","full_name":"NetSPI/httpillage","owner":"NetSPI","description":null,"archived":false,"fork":false,"pushed_at":"2017-04-08T14:22:53.000Z","size":5864,"stargazers_count":26,"open_issues_count":6,"forks_count":3,"subscribers_count":19,"default_branch":"master","last_synced_at":"2024-04-14T18:14:30.001Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NetSPI.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-06-05T23:38:05.000Z","updated_at":"2023-06-21T21:53:17.000Z","dependencies_parsed_at":"2022-09-12T19:23:01.415Z","dependency_job_id":null,"html_url":"https://github.com/NetSPI/httpillage","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2Fhttpillage","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2Fhttpillage/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2Fhttpillage/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NetSPI%2Fhttpillage/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NetSPI","download_url":"https://codeload.github.com/NetSPI/httpillage/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224032926,"owners_count":17244506,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T01:20:15.848Z","updated_at":"2024-11-11T01:20:16.749Z","avatar_url":"https://github.com/NetSPI.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"httpillage is a command and control server designed to increase the effectiveness of Web-App testing through distributed attacks. HTTP(S) requests will be loaded into\nthe command and control server via the httpillage burp extender, or directly within the C\u0026C web interface. Clients will be deployed on servers continuously polling the C\u0026C looking for jobs, executing as they are made available.\n\nhttpillage current supports three modes of attack:\n\n- Repeat: Designed for repeating a baseline request in rapid fashion, with a large quantity of threads. Useful in performance testing\n- Dictionary: Iterate through a dictionary file to inject paylods in the HTTP request via custom defined payload markers `{P}`\n- Bruteforce: Perform bruteforce attacks against a specified keyspace. Currently supports upper-case (u), lower-case (l) and numeric (d). To test a keyspace that matches [a-z][0-9]{3} provide the charset: `lddd`.\n\nResponse matching can be used to determine successful execution of a specific payload. When creating the job specify zero or more response matching strings or regular expressions. Upon receiving the job, nodes will be aware of the patterns to analyze, reporting back to the C\u0026C upon success.\n\nDeploying the Server \n---------------------\nEnsure that the firewall will allow inbound access on port 3000, or specify a unique port.\n\n\t$ bundle install\n\t$ rake db:migrate db:seed\n\t$ rails s -b 0.0.0.0\n\nDeploying the Nodes\n-----\nThe nodes have only been tested with Ruby 2.2.3. Before deploying obtain a copy of the Node API Key from the C\u0026C Settings panel (http://localhost:3000/settings). This key is used to authenticate the nodes. Providing an invalid key will result in server exceptions.\n\n\t$ bundle install\n\t$ ruby httpillage.rb --server=\"http://server:3000\" --api-key=\"[APIKEY]\"\n\nUpon starting the client it'll constantly poll the server until it recieves a job. The client will spin up 5 threads that continuously send requests on behalf of the job. Clients will stop execution once the server changes the job status. \n\nBuilding Extender .Jar\n----------------------\n\nTo build the extender .jar file, we first need to ensure that the system has ant, and is running version Java 7 or higher.\n\nNavigate to the extender/bin/burp directory:\n\n  $ cd extender/bin/burp\n\nBuild the jar using Apache ant:\n\n  $ ant\n\nAfter this has completed you should see a BUILD SUCCESSFUL message. The .jar file is located in extender/bin/burp/httpillage.jar. Import this into Burp.\n\nUpdate the Server and API Token textfields within Burp to represent the values for the custom httpillage implementation.\n\nInside the proxy history table, right click any request and \"send to httpillage.\" This will queue up the job on the C\u0026C server. For verification that the response was recieved properly, click on the extender tab and you should see a C\u0026C JSON encoded response within the Output tab.\n\nPotential Use Cases\n----------------------\n- Denial of Service Testing\n- Username Enumeration\n- Defeating expiring tokens\n- Forced Browsing","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetspi%2Fhttpillage","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnetspi%2Fhttpillage","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetspi%2Fhttpillage/lists"}