Userspace ignore IP set

krisnova / boopkit

Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.

Apache License 2.0

1.54k stars 167 forks source link

Open krisnova opened 2 years ago

krisnova commented 2 years ago

The new #4 feature has noisy public servers firing off ncat commands against it self alot.

Ideally we offer a "denylist" that can be plumbed through to boopkit at runtime so that we only are responding to specific blocks of IPs.

I wonder if there is a good CIDR library in C?

krisnova commented 2 years ago

We now have -x however it can be better by using CIDR notation. We will need to find an assertion library for this.