1. Backdooring enemies with a Proxy …..
Jovin Lobo & Aditya Vasekar

2. About Us ‘Security Enthusiasts’ from Pune
Members of null – The Open Security Community (
Recurring null Pune Chapter meets
Work as Information Security Analysts.
Like to research and present on random security subjects …
Twitter:
@7h3_j0k3r
@adityavasekar

3. Why this Talk ?
Were inspired by Cheema Alonso’s talk on creating JavaScript Botnets.
Wanted to create a similar POC and use it for gathering intel.
This talk is more of a ‘blueprint’ for configuring and deploying a Proxy that adds Javascript backdoors/malicious code.
Wanted to share the dangers of using online anonymous proxies.
Most importantly – We were excited to c0c0n 2016 

4. What is a Anonymous Proxy ?

5. Free Proxies …. Are they really free ?

6. Malicious users behind Proxies

7. How Our Proxy works

8. Getting a foot in their Browsers

9. The Components used Squid + URL rewrite Javascript Payload
What's Squid ?
What's URL rewrite program in Squid ?
Javascript Payload
Log Analyzers
Analyzing Squid Logs

10. SQUID Proxy
Squid is a Unix based proxy server which caches the Internet content closer to a requestor than its original point.
ISPs are using it since long time for faster downloads and other stuff.
Its open source.

11. How Squid Works for backdooring end Users.
Look for specific requests (eg: .js files)
Download the JavaScript file.
Append this JS file with our Javascript Payload.
Serve the end user this modified Javascript file.

13. Demo – Bringing it all together

14. Beef framework
The Browser exploitation framework, used as a penetration testing tool which focuses on the browser based attacks.

15. Analyzing Logs …

16. Logstash
Have ability to process logs from different systems and events.
Can be extended to the custom log formats.

17. Elastic search Open source under Apache License.
A distributed RESTful search engine, specifically developed for the cloud.
Built on the top of Lucene.
Reliable, Asynchronous Write Behind for long term persistency.
Supports different set of API: HTTP restful API, Native Java API
Multi Tenant with Multi Types

18. kibana
It’s a flexible visualization platform, which can present with the real-time summary and charting of data.
Variety of interfaces to interact and represent to.
Dashboards.

19. Any Questions ?

20. Thank You

21. NO really …