Installing and configuring redirectors as part of your red team infrastructure. Follow these step-by-step instructions to deploy and optimize redirectors using tools like Filebeat and RedELK, enhancing your ability to manage logs and security measures effectively.
Learn how to tackle common installation challenges and modify logging formats for different server types to suit your operational needs.
redirs.tgz
install-redir.sh $FilebeatID $ScenarioName $IP/DNS:PORT
Copy and extract the redirs.tgz you generated in the previous step on your redirector as part of your red team infra deployment procedures. Run: install-redir.sh $FilebeatID $ScenarioName $IP/DNS:PORT
$FilebeatID
is the identifier of this redirector within filebeat.$ScenarioName
is the name of the attack scenario this redirector is used for.$IP/DNS:PORT
is the IP or DNS name and port where filebeat logs are shipped to, this would be the IP/DNS of your RedELK server. Even if you use the default port (TCP/5044) you need to provide this as a parameter.This script will set install filebeat and dependencies, install the required certificates, adjust the filebeat configuration and start filebeat.
Having issues? Check the following:
redelk-install.log
./var/log/filebeat
or filebeat
mentioned in /var/log/syslog
depending on your Linux flavour used). You want to make sure it is tracking the right log files. And you want to make sure it can connect to the RedELK server. If no connection is established, this is often due to firewall issues, or due to incorrect SSL parameters given in the certs/config.cfg
file.The applications used for redirection still need manual tuning in order to get the most out of them. This is done differently for Apache, Nginx and HAProxy. Details of each can be found below, and example configuration files are shipped with the RedELK package in the example-data-and-configs folder
See Naming requirements for detailed info on naming requirements.
RedELK requires:
a2enmod rewrite proxy proxy_http proxy_connect ssl proxy_html deflate headers
to do so.LogFormat "%t %{hostname}e apache[%P]: frontend:%{frontend_name}e/%A:%{local}p backend:%{backend_name}e client:%h:%{remote}p xforwardedfor:%{X-Forwarded-For}i headers:{%{User-Agent}i|%{Host}i|%{X-Forwarded-For}i|%{X-Forwarded-Proto}i|%{X-Host}i|%{Forwarded}i|%{Via}i|} statuscode:%s request:%r" redelklogformat
CustomLog ${APACHE_LOG_DIR}/access-redelk.log redelklogformat
An example Apache config file can be found here
By default Filebeat on the redirector will look at the log file /var/log/apache2/access-redelk.log
. You can change these manually in the filebeat config file.
For more information click here.
WID_LoadLibrary is a custom implementation inspired by the Windows API function LoadLibrary, which is used…
Locksmith is a specialized tool designed to identify and remediate vulnerabilities in Active Directory Certificate…
Uscrapper Vanta is a powerful open-source intelligence (OSINT) tool designed to revolutionize web scraping and…
Pake is an innovative tool designed to convert any webpage into a desktop application with…
Bevy is an open-source, data-driven game engine built in Rust, designed to simplify game development…
AppFlowy Cloud is a robust component of the AppFlowy ecosystem, designed to provide secure user…