transform

Documentation

Index

• Constants
• Variables
• func DefaultDomains() []string
• type B64
  • func B64Shift(n int) B64
  • func (b B64) Read(p []byte, w io.Writer) error
  • func (b B64) Write(p []byte, w io.Writer) error
• type DNSTransform
  • func (d DNSTransform) Read(b []byte, w io.Writer) error
  • func (d DNSTransform) Write(b []byte, w io.Writer) error

Constants

const Base64 = B64(0)

Base64 is a transform that auto converts the data to and from Base64 encoding. This instance does not include any shifting.

Variables

var (
	// DNS is the standard DNS Transform alias. This alias uses the default
	// DNS addresses contained in 'DefaultDomains()' to spoof C2 communications
	// as valid DNS packets.
	//
	// Custom options may be used by creating a new DNS alias or updating the
	// current alias (string array) with new domains.
	DNS = DNSTransform{}
)

Functions

func DefaultDomains

func DefaultDomains() []string

DefaultDomains returns an array of DNS names to be used if the DNS Transform is empty.

Types

type B64

type B64 byte

B64 is the underlying type for the Base64 Transform. This Transform encodes data into a Base64 string before the final write to the output.

func B64Shift

func B64Shift(n int) B64

B64Shift returns a Base64 Transform that also shifts the bytes by the specified amount before writes and after reads. This is useful for evading detection by avoiding commonly flagged Base64 values.

func (B64) Read

func (b B64) Read(p []byte, w io.Writer) error

Read satisfies the Transform interface requirements.

func (B64) Write

func (b B64) Write(p []byte, w io.Writer) error

Write satisfies the Transform interface requirements.

type DNSTransform

type DNSTransform []string

DNSTransform is a Transform alias that attempts to mask C2 traffic in the form of DNS request packets.

func (DNSTransform) Read

func (d DNSTransform) Read(b []byte, w io.Writer) error

Read satisfies the Transform interface requirements.

func (DNSTransform) Write

func (d DNSTransform) Write(b []byte, w io.Writer) error

Write satisfies the Transform interface requirements.