        ● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
      

Multi-protocol network egress assessment and DLP verification framework featuring automated L4 sweeps, corporate proxy traversal, and covert protocol smuggling across 20+ channels.

$ git clone https://shehzade.io/repos/contraband.git Copy

Source ZIP (1.93 MB)

Code 174 Commits 1

← Back to directory

3.3 KB

Raw

Proxy Traversal and Evasion Reference

Contraband includes an autonomous proxy evaluation and evasion engine designed to bypass corporate enterprise gateways, next-generation firewalls, and TLS inspection appliances.

1. Proxy Evaluation Engine (`--proxy`)

The proxy engine supports automated environment discovery and explicit configuration:

Mode	Syntax	Description
Auto (Default)	`--proxy auto`	Sequentially probes environment variables (`HTTP_PROXY`, `HTTPS_PROXY`), system PAC, WPAD, and direct outbound routing.
Direct	`--proxy direct`	Enforces direct socket connection bypassing all local proxy settings.
Explicit HTTP	`--proxy http://proxy.corp:8080`	Routes traffic through an explicit HTTP CONNECT forward proxy.
SOCKS5	`--proxy socks5://127.0.0.1:1080`	Routes all TCP probes and streams through a SOCKS5 proxy.

Authentication Modes (`--proxy-auth`)

Mode	Authentication Protocol	Description
`basic`	Base64 Encoded Credentials	Transmits standard `Proxy-Authorization: Basic <credentials>`.
`ntlm`	NTLMv1 / NTLMv2 Challenge-Response	Pure Go Type 1 negotiation, Type 2 challenge parsing, and Type 3 response generation.
`negotiate` / `kerberos`	SPNEGO Encapsulation	Authenticates using Kerberos SPNEGO token exchange.

2. TLS Fingerprint Masquerade (`--tls-fingerprint` / `--utls`)

Enterprise TLS inspection appliances (BlueCoat, Palo Alto, Zscaler) flag Go's default crypto/tls Client Hello signature. Contraband integrates uTLS to mirror authentic browser handshakes:

BASH

# Mimic modern Chrome browser
contraband-client --tls-fingerprint chrome

# Mimic Edge, Safari, Firefox, or curl
contraband-client --tls-fingerprint edge
contraband-client --tls-fingerprint safari
contraband-client --tls-fingerprint firefox
contraband-client --tls-fingerprint curl

This randomizes and aligns:

TLS 1.3 Cipher Suites and Extension ordering
Supported Elliptic Curves (X25519, P-256, P-384)
Application Layer Protocol Negotiation (ALPN: h2, http/1.1)
SNI extensions, session ticket parameters, and key share formatting

3. Traffic Cadence and Rate Limiting

To evade anomaly detection and volume thresholds in SIEM and NDR platforms:

BASH

# Rate limiting
contraband-client --throughput 500KB/s     # Cap outbound transfer speed
contraband-client --rate-limit 100         # Cap L4 sweep packets per second

# Cadence pacing
contraband-client --cadence steady         # Fixed-interval chunk emission
contraband-client --cadence jittered       # Randomized sleep between chunks (500ms - 4s)
contraband-client --cadence burst          # High-speed chunk emission followed by dormant periods
contraband-client --cadence office-hours   # Transmits exclusively during active business hours

4. Evasion Transforms (`--transforms`)

Data chunks can be processed through sequential transformation chains before transmission:

BASH

# Compress and encrypt payload chunks
contraband-client --transforms gzip,aes_gcm --passphrase "SecretPassphrase123"

# Base64 or Hex encoding for text-only inspection channels
contraband-client --transforms zstd,base64

Supported transforms: raw, base64, hex, gzip, zstd, aes_gcm.

1	# Proxy Traversal and Evasion Reference
2
3	Contraband includes an autonomous proxy evaluation and evasion engine designed to bypass corporate enterprise gateways, next-generation firewalls, and TLS inspection appliances.
4
5	---
6
7	## 1. Proxy Evaluation Engine (`--proxy`)
8
9	The proxy engine supports automated environment discovery and explicit configuration:
10
11	\| Mode \| Syntax \| Description \|
12	\| :--- \| :--- \| :--- \|
13	\| Auto (Default) \| `--proxy auto` \| Sequentially probes environment variables (`HTTP_PROXY`, `HTTPS_PROXY`), system PAC, WPAD, and direct outbound routing. \|
14	\| Direct \| `--proxy direct` \| Enforces direct socket connection bypassing all local proxy settings. \|
15	\| Explicit HTTP \| `--proxy http://proxy.corp:8080` \| Routes traffic through an explicit HTTP CONNECT forward proxy. \|
16	\| SOCKS5 \| `--proxy socks5://127.0.0.1:1080` \| Routes all TCP probes and streams through a SOCKS5 proxy. \|
17
18	### Authentication Modes (`--proxy-auth`)
19
20	\| Mode \| Authentication Protocol \| Description \|
21	\| :--- \| :--- \| :--- \|
22	\| `basic` \| Base64 Encoded Credentials \| Transmits standard `Proxy-Authorization: Basic <credentials>`. \|
23	\| `ntlm` \| NTLMv1 / NTLMv2 Challenge-Response \| Pure Go Type 1 negotiation, Type 2 challenge parsing, and Type 3 response generation. \|
24	\| `negotiate` / `kerberos` \| SPNEGO Encapsulation \| Authenticates using Kerberos SPNEGO token exchange. \|
25
26	---
27
28	## 2. TLS Fingerprint Masquerade (`--tls-fingerprint` / `--utls`)
29
30	Enterprise TLS inspection appliances (BlueCoat, Palo Alto, Zscaler) flag Go's default `crypto/tls` Client Hello signature. Contraband integrates `uTLS` to mirror authentic browser handshakes:
31
32	```bash
33	# Mimic modern Chrome browser
34	contraband-client --tls-fingerprint chrome
35
36	# Mimic Edge, Safari, Firefox, or curl
37	contraband-client --tls-fingerprint edge
38	contraband-client --tls-fingerprint safari
39	contraband-client --tls-fingerprint firefox
40	contraband-client --tls-fingerprint curl
41	```
42
43	This randomizes and aligns:
44	- TLS 1.3 Cipher Suites and Extension ordering
45	- Supported Elliptic Curves (`X25519`, `P-256`, `P-384`)
46	- Application Layer Protocol Negotiation (ALPN: `h2, http/1.1`)
47	- SNI extensions, session ticket parameters, and key share formatting
48
49	---
50
51	## 3. Traffic Cadence and Rate Limiting
52
53	To evade anomaly detection and volume thresholds in SIEM and NDR platforms:
54
55	```bash
56	# Rate limiting
57	contraband-client --throughput 500KB/s # Cap outbound transfer speed
58	contraband-client --rate-limit 100 # Cap L4 sweep packets per second
59
60	# Cadence pacing
61	contraband-client --cadence steady # Fixed-interval chunk emission
62	contraband-client --cadence jittered # Randomized sleep between chunks (500ms - 4s)
63	contraband-client --cadence burst # High-speed chunk emission followed by dormant periods
64	contraband-client --cadence office-hours # Transmits exclusively during active business hours
65	```
66
67	---
68
69	## 4. Evasion Transforms (`--transforms`)
70
71	Data chunks can be processed through sequential transformation chains before transmission:
72
73	```bash
74	# Compress and encrypt payload chunks
75	contraband-client --transforms gzip,aes_gcm --passphrase "SecretPassphrase123"
76
77	# Base64 or Hex encoding for text-only inspection channels
78	contraband-client --transforms zstd,base64
79	```
80
81	Supported transforms: `raw`, `base64`, `hex`, `gzip`, `zstd`, `aes_gcm`.

# Proxy Traversal and Evasion Reference

Contraband includes an autonomous proxy evaluation and evasion engine designed to bypass corporate enterprise gateways, next-generation firewalls, and TLS inspection appliances.

---

## 1. Proxy Evaluation Engine (`--proxy`)

The proxy engine supports automated environment discovery and explicit configuration:

| Mode | Syntax | Description |
| :--- | :--- | :--- |
| **Auto** (Default) | `--proxy auto` | Sequentially probes environment variables (`HTTP_PROXY`, `HTTPS_PROXY`), system PAC, WPAD, and direct outbound routing. |
| **Direct** | `--proxy direct` | Enforces direct socket connection bypassing all local proxy settings. |
| **Explicit HTTP** | `--proxy http://proxy.corp:8080` | Routes traffic through an explicit HTTP CONNECT forward proxy. |
| **SOCKS5** | `--proxy socks5://127.0.0.1:1080` | Routes all TCP probes and streams through a SOCKS5 proxy. |

### Authentication Modes (`--proxy-auth`)

| Mode | Authentication Protocol | Description |
| :--- | :--- | :--- |
| `basic` | Base64 Encoded Credentials | Transmits standard `Proxy-Authorization: Basic <credentials>`. |
| `ntlm` | NTLMv1 / NTLMv2 Challenge-Response | Pure Go Type 1 negotiation, Type 2 challenge parsing, and Type 3 response generation. |
| `negotiate` / `kerberos` | SPNEGO Encapsulation | Authenticates using Kerberos SPNEGO token exchange. |

---

## 2. TLS Fingerprint Masquerade (`--tls-fingerprint` / `--utls`)

Enterprise TLS inspection appliances (BlueCoat, Palo Alto, Zscaler) flag Go's default `crypto/tls` Client Hello signature. Contraband integrates `uTLS` to mirror authentic browser handshakes:

```bash
# Mimic modern Chrome browser
contraband-client --tls-fingerprint chrome

# Mimic Edge, Safari, Firefox, or curl
contraband-client --tls-fingerprint edge
contraband-client --tls-fingerprint safari
contraband-client --tls-fingerprint firefox
contraband-client --tls-fingerprint curl
```

This randomizes and aligns:
- TLS 1.3 Cipher Suites and Extension ordering
- Supported Elliptic Curves (`X25519`, `P-256`, `P-384`)
- Application Layer Protocol Negotiation (ALPN: `h2, http/1.1`)
- SNI extensions, session ticket parameters, and key share formatting

---

## 3. Traffic Cadence and Rate Limiting

To evade anomaly detection and volume thresholds in SIEM and NDR platforms:

```bash
# Rate limiting
contraband-client --throughput 500KB/s     # Cap outbound transfer speed
contraband-client --rate-limit 100         # Cap L4 sweep packets per second

# Cadence pacing
contraband-client --cadence steady         # Fixed-interval chunk emission
contraband-client --cadence jittered       # Randomized sleep between chunks (500ms - 4s)
contraband-client --cadence burst          # High-speed chunk emission followed by dormant periods
contraband-client --cadence office-hours   # Transmits exclusively during active business hours
```

---

## 4. Evasion Transforms (`--transforms`)

Data chunks can be processed through sequential transformation chains before transmission:

```bash
# Compress and encrypt payload chunks
contraband-client --transforms gzip,aes_gcm --passphrase "SecretPassphrase123"

# Base64 or Hex encoding for text-only inspection channels
contraband-client --transforms zstd,base64
```

Supported transforms: `raw`, `base64`, `hex`, `gzip`, `zstd`, `aes_gcm`.

Proxy Traversal and Evasion Reference

1. Proxy Evaluation Engine (--proxy)

Authentication Modes (--proxy-auth)

2. TLS Fingerprint Masquerade (--tls-fingerprint / --utls)

3. Traffic Cadence and Rate Limiting

4. Evasion Transforms (--transforms)

1. Proxy Evaluation Engine (`--proxy`)

Authentication Modes (`--proxy-auth`)

2. TLS Fingerprint Masquerade (`--tls-fingerprint` / `--utls`)

4. Evasion Transforms (`--transforms`)