threatexpress/random_c2_profile

random HTTP content is not OPSEC safe

superuser5 opened this issue · 3 comments

superuser5 commented

Hello,

thanks for the great project.

the get_http_content() function returns non OPSEC safe HTTP blob.

random_c2_profile/core/functions.py

Line 91 in cb71b2e

def get_http_content():

Thanks

vestjoe commented

I'm updating now for 4.7, but 1. This was designed to be a generic randomizer to help bootstrap a template. You can tweak as you'd like. 2. What specifically is not OPSEC safe?

superuser5 commented

Thank you for updating the tool. I was referring to that jquery blob and the get_process_inject_execute could put CreateRemoteThread in first and is heavily detected.

superuser5 commented

thank you for improving the get_http_content, closing the issue