Regarding opsec and strip/remap-path-prefix about offensiverust HOT 6 CLOSED

I mostly use msvc, try to use the same flags for cargo and write the write arguments for cargo build and let me know cause I'm my case , it is totally fine without home dir

from offensiverust.

I tried the arguments, etc. you suggested (the only difference from mine were trim-path and the build-std flags) before I posted the issue. I also updated to the latest version to see if anything had changed. You can see my default configuration below.

# .cargo/config.toml

[profile.release]
codegen-units = 1
panic = "abort"
lto = true
opt-level = "z"
strip = "symbols"

# Cargo.toml
# cargo-features = ["strip"] isn't necessary since Rust 1.58

[package]
name = "something"
version = "0.1.0"
edition = "2021"

# standard [[bin]] and [dependencies], etc.

cargo build --release --target=x86_64-pc-windows-gnu -Z build-std=std,panic_abort -Z build-std-features=panic_immediate_abort 

If you are not seeing any references to the home directory, it could be due to different dependencies.
I ran the current samples with your suggested configuration and both with and without the build-std flags.
http-https-requests seem to have the most instances of username. reqwest, openssl, and wmi are the likely culprits.

This issue will be solved eventually when trim-paths is merged into standard (likely in the next edition, 2024?) but in the meantime, strip isn't enough for every case. It might be better to reword the section in the readme.

from offensiverust.

@trickster0 Anyway, this is your package and your advice in the readme. If you are comfortable with leaving it as it is, I don't mind. I just thought you should know.

from offensiverust.

Hey, yup I checked it and you are right depending on the libraries imported it still might include the path, so i updated the readme. thx man.

from offensiverust.

Thank you! Apologies if I came off standoffish 😅

from offensiverust.

You did but that is okay 😅 I had to check and verify yet.

from offensiverust.