Hacking Articles Tips Tricks Videos Tutorials

FaPro is a Fake Protocol Server tool, Can easily start or stop multiple network services.The goal is to support as many protocols (https://www.kitploit.com/search/label/Protocols) as possible, and support as many deep interactions as possible for each protocol.
Features
Supported Running Modes: Local MachineVirtual NetworkSupported Protocols: DNSDCE/RPCEIPElasticsearchFTPHTTPIEC 104MemcachedModbusMQTTMySQLRDPRedisS7SMBSMTPSNMPSSHTelnetVNCIMAPPOP3Use TcpForward to forward network trafficSupport tcp syn logging
Protocol simulation (https://www.kitploit.com/search/label/Simulation) demos

Rdp
Support credssp ntlmv2 nla authentication.Support to configure the image displayed when user login.

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

7 viewsedited 21:34

Hacking Articles Tips Tricks Videos Tutorials

6 views21:34

Hacking Articles Tips Tricks Videos Tutorials

SSH
Support user login.Support fake terminal commands, such as id, uid, whoami, etc.Account format: username:password:home:uid

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 21:34

Hacking Articles Tips Tricks Videos Tutorials

6 views21:34

Hacking Articles Tips Tricks Videos Tutorials

IMAP & SMTP
Support user login and interaction.

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 21:34

Hacking Articles Tips Tricks Videos Tutorials

6 views21:34

Hacking Articles Tips Tricks Videos Tutorials

Mysql
Support sql statement query interaction

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 21:34

Hacking Articles Tips Tricks Videos Tutorials

6 views21:34

Hacking Articles Tips Tricks Videos Tutorials

HTTP
Support website clone, You need to install the chrome browser and chrome driver (https://chromedriver.chromium.org/downloads) to work.
Quick Start

Generate Config
The configuration of all protocols and parameters is generated by genConfig subcommand.Use 172.16.0.0/16 subnet to generate the configuration file: fapro.json ">fapro genConfig -n 172.16.0.0/16 > fapro.jsonOr use local address instead of the virtual network: fapro.json ">fapro genConfig > fapro.json
Run the protocol simulator
Run FaPro in verbose mode and start the web service on port 8080:fapro run -v -l :8080
Tcp syn logging
For windows users, please install winpcap (https://www.winpcap.org/install/) or npcap (https://nmap.org/npcap/).
Log analysis
Use ELK to analyze protocol logs:

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 21:34

Hacking Articles Tips Tricks Videos Tutorials

6 views21:34

Hacking Articles Tips Tricks Videos Tutorials

Configuration
This section contains the sample configuration used by FaPro.{
"version": "0.38",
"network": "127.0.0.1/32",
"network_build": "localhost",
"storage": null,
"geo_db": "/tmp/geoip_city.mmdb",
"hostname": "fapro1",
"use_logq": true,
"cert_name": "unknown",
"syn_dev": "any",
"exclusions": [],
"hosts": [
{
"ip": "127.0.0.1",
"handlers": [
{
"handler": "dcerpc",
"port": 135,
"params": {
"accounts": [
"administrator:123456",
],
"domain_name": "DESKTOP-Q1Test"
}
}
]
}
]
}
version: Configuration version.network: The subnet used by the virtual network or the address bound to the local machine(Local mode).network_build: Network mode(supported value: localhost, all, userdef) localhost: Local mode, all services are listening on the local machineall: Create all hosts in the subnet(i.e., Can ping all the host in the subnet)userdef: Create only the hosts specified in the hosts configuration.storage: Specify the storage used for log collection, support sqlite, mysql, elasticsearch. e.g. sqlite3:logs.dbmysql://user:password@tcp(127.0.0.1:3306)/logses://http://127.0.0.1:9200 (http://127.0.0.1:9200/) (currently only supports Elasticsearch (https://www.kitploit.com/search/label/Elasticsearch) 7.x)geo_db: MaxMind geoip2 database file path, used to generate ip geographic location information. if you use Elasticsearch storage, never need this field, it will be automatically generated using the geoip processor of Elasticsearch.hostname: Specify the host field in the log.use_logq: Use local disk message queue to save logs, and then send it to remote mysql or Elasticsearch to prevent remote log loss.cert_name: Common name of the generated certificate.syn_dev: Specify the network interface used to capture (https://www.kitploit.com/search/label/Capture) tcp syn packets. If it is empty, the tcp syn packet will not be recorded. On windows, the device name is like "\Device\NPF_{xxxx-xxxx}".exclusions: Exclude remote ips from logs.hosts: Each item is a host configuration.handlers: Service configuration, the service configured on the host, each item is a service configuration.handler: Service name (i.e., protocol name)params: Set the parameters supported by the service.
Example
Create a virtual network, The subnet is 172.16.0.0/24, include 2 hosts,172.16.0.3 run dns, ssh service,and 172.16.0.5 run rpc, rdp service,protocol access logs are saved to elasticsearch, exclude the access log of 127.0.0.1.{
"version": "0.38",
"network": "172.16.0.0/24",
"network_build": "userdef",
"storage": "es://http://127.0.0.1:9200",
"use_logq": true,
"cert_name": "unknown",
"syn_dev": "any",
"geo_db": "",
"exclusions": ["127.0.0.1"],
"hosts": [
{
"ip": "172.16.0.3",
"handlers": [
{
"handler": "dns",
"port": 53,
"params": {
"accounts": [
"admin:123456"
],
"appname": "domain"
}
},
{
"handler": "ssh",
"port": 22,
"params": {
"accounts": [
"root:5555555:/root:0"
],
"prompt": "$ ",
"server_version": "SSH-2.0-OpenSSH_7.4"
}
}
]
},
{
"ip": "172.16.0.5",
"handlers": [
{
"handler": "dcerpc",
"port": 135,

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

7 viewsedited 21:34

About

Blog

Apps

Platform