NetLlix: A tool to simulate and test exfiltration of data over different network protocols

NetLlix is a project that aims to simulate and test data exfiltration over various network protocols. Emulation takes place without the use of any native API’s. Blue teams can use this information to create correlation rules that detect data exfiltration or C2 communication.

This project is currently able to generate HTTP/HTTPS (both POST and GET) traffic using the following programming/scripting languages.

• CNet/WebClient is a CLang application that generates network traffic by using the well-known WIN32 API’s, (WININET & WINHTTP), and socket programming.
• HashNet/WebClient is a C# binary that generates network traffic by using the.NET classes HttpClient and WebRequest.
• PowerNet/WebClient – PowerShell scripts for generating network traffic via socket programming

Use

Get the most recent ZIP file from realease.

Run The Server

• With SSl python3 HTML-S-EXFIL.py ssl
• Without SSL: Python3 HTTP–S-EXFIL.py

The client is running

• CNet.exe CNet.exe Server-IP-ADDRESS Select an option
• HashNet – ChashNet.exe Server-IP-ADDRESS Select an option
• PowerNet – .PowerHttp.ps1-ip-Server-IP–ADDRESS>-port 80/443>-method GET/POST>