# Egress-Assess

Source: <https://github.com/FortyNorthSecurity/Egress-Assess>

Source 2: <https://www.christophertruncer.com/egress-assess-testing-egress-data-detection-capabilities/>

*"Egress-Assess can act as both the client and the server for the protocol you wish to simulate. It supports exfiltration testing over HTTP, HTTPS, and FTP".*

## How to extract files

If you're going to use HTTPs, you need to generate a server certificate:

```
openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
```

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2F70ZQmFoM0biWLt81zkDd%2Fimage.png?alt=media&#x26;token=9c69263f-73d6-4fc6-8750-a20b1d4a99aa" alt=""><figcaption><p>Open a server on the Attacker</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FVJiHKBuOOkVV4pdJUUDe%2Fimage.png?alt=media&#x26;token=975b47b9-00ce-4956-b40e-a4d400f17772" alt=""><figcaption><p>Server HTTPS opened</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FJTg98xk72b1dRSqo9p0u%2Fimage.png?alt=media&#x26;token=88645e37-a34c-4dac-adc5-c22ab140860a" alt=""><figcaption><p>Send the file you want</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FmT4kS99eMxmR2qcYY30k%2Fimage.png?alt=media&#x26;token=8da64cca-e484-4790-bf77-3f777582fc44" alt=""><figcaption><p>Shadow extracted</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FUJtj8NWS2g0sEvS8UIl4%2Fimage.png?alt=media&#x26;token=55e52d7a-d857-4295-8873-25672e9389bb" alt=""><figcaption><p>PoC - /etc/shadow file</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FXBFpDGlz2sW9bsq4rUT8%2Fimage.png?alt=media&#x26;token=b52a2069-2bf9-4c22-b6cb-4db1eb03cf03" alt=""><figcaption><p>Wireshark Results</p></figcaption></figure>

* We can also transfer files over FTP or HTTP

We can specify the port with **--server-port \<port>**

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2F8q2JJ8dh2ffjETu3hOwf%2Fimage.png?alt=media&#x26;token=6a089f9b-24a8-4826-89bd-8c7bf421340b" alt=""><figcaption><p>HTTP server</p></figcaption></figure>

And for FTP, we can specify a user and password as follows:

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2Ft6miFV46ljcg0uPoSBQs%2Fimage.png?alt=media&#x26;token=9f2d43ab-7733-40f6-8dd2-ee80223d09f2" alt=""><figcaption><p>FTP server</p></figcaption></figure>
