Pentesting Tools

Redirector Installation – A Comprehensive Guide For Red Team Operations

Installing and configuring redirectors as part of your red team infrastructure. Follow these step-by-step instructions to deploy and optimize redirectors using tools like Filebeat and RedELK, enhancing your ability to manage logs and security measures effectively.

Learn how to tackle common installation challenges and modify logging formats for different server types to suit your operational needs.

In Short

  1. extract redirs.tgz
  2. Run: install-redir.sh $FilebeatID $ScenarioName $IP/DNS:PORT
  3. Modify the logging format of your reverse proxy

In Detail

Copy and extract the redirs.tgz you generated in the previous step on your redirector as part of your red team infra deployment procedures. Run: install-redir.sh $FilebeatID $ScenarioName $IP/DNS:PORT

  • $FilebeatID is the identifier of this redirector within filebeat.
  • $ScenarioName is the name of the attack scenario this redirector is used for.
  • $IP/DNS:PORT is the IP or DNS name and port where filebeat logs are shipped to, this would be the IP/DNS of your RedELK server. Even if you use the default port (TCP/5044) you need to provide this as a parameter.

This script will set install filebeat and dependencies, install the required certificates, adjust the filebeat configuration and start filebeat.

Debugging

Having issues? Check the following:

  • The installer output in redelk-install.log.
  • Filebeat errors in its log file (/var/log/filebeat or filebeat mentioned in /var/log/syslog depending on your Linux flavour used). You want to make sure it is tracking the right log files. And you want to make sure it can connect to the RedELK server. If no connection is established, this is often due to firewall issues, or due to incorrect SSL parameters given in the certs/config.cfg file.

Modify Logging Format

The applications used for redirection still need manual tuning in order to get the most out of them. This is done differently for Apache, Nginx and HAProxy. Details of each can be found below, and example configuration files are shipped with the RedELK package in the example-data-and-configs folder

See Naming requirements for detailed info on naming requirements.

Apache Specifics

RedELK requires:

  1. Enabling of Apache specific modules. Run a2enmod rewrite proxy proxy_http proxy_connect ssl proxy_html deflate headers to do so.
  2. modification to the default Apache configuration in order to log more details. Most importantly are the ‘LogFormat’ and ‘CustomLog’ directives:
  • LogFormat "%t %{hostname}e apache[%P]: frontend:%{frontend_name}e/%A:%{local}p backend:%{backend_name}e client:%h:%{remote}p xforwardedfor:%{X-Forwarded-For}i headers:{%{User-Agent}i|%{Host}i|%{X-Forwarded-For}i|%{X-Forwarded-Proto}i|%{X-Host}i|%{Forwarded}i|%{Via}i|} statuscode:%s request:%r" redelklogformat
  • CustomLog ${APACHE_LOG_DIR}/access-redelk.log redelklogformat

An example Apache config file can be found here

By default Filebeat on the redirector will look at the log file /var/log/apache2/access-redelk.log. You can change these manually in the filebeat config file.

For more information click here.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Playwright-MCP : A Powerful Tool For Browser Automation

Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…

3 weeks ago

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

3 weeks ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

3 weeks ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

3 weeks ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

3 weeks ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

3 weeks ago