Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sliver proxy connection leak User-agent #1775

Open
nikaiw opened this issue Sep 10, 2024 · 2 comments
Open

Sliver proxy connection leak User-agent #1775

nikaiw opened this issue Sep 10, 2024 · 2 comments
Labels
bug Something isn't working

Comments

@nikaiw
Copy link

nikaiw commented Sep 10, 2024

Describe the bug
With default configuration, when a beacon connect through a proxy, sliver seems to leak it's user-agent. "Go-http-client"
To Reproduce
Steps to reproduce the behavior:
generate a beacon with proxy

Expected behavior
sliver use it's randomly generated user-agent
Screenshots
image

@moloch-- moloch-- added the bug Something isn't working label Sep 13, 2024
@alcastronic
Copy link

Can confirm this behavior. It uses the Go-Http-Client user agent in the Connect request.

$ python3 htt.py 
Server started http://xxx.xxx.xxx.xxx:3123

[+] CONNECT method called!
Host: api.example.com:443
User-Agent: Go-http-client/1.1


[+] POST method called!
Host: api.example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Length: 294
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip

@alcastronic
Copy link

This might be a solution, https://stackoverflow.com/questions/39577378/golang-net-http-transport-proxy-connect-method-header-supporting. Have not tested it yet, and I'm not really a go programmer, but it looks promising.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants