Chisel: A fast TCP/UDP tunnel over HTTP

Re:Chisel: A fast TCP/UDP tunnel over HTTP by MuffinFlavored on Saturday April 06, 2024 @01:22PM (#39953868)

I've used this before and it's great as a "reverse tunnel" when you have a VM in the cloud that does allow configurable port forwarding/firewall rules but need to connect "peer to peer" to a customer in a workshop who has the typical "my router blocks everything and we aren't going to spend the time supporting every workshop's possible inbound network connection setup".

It helps for "flipping" the "server connects to client".

But... it gets detected as malware really easily haha

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by asib on Saturday April 06, 2024 @02:13PM (#39954279)

> But... it gets detected as malware really easily haha

It's a common tool in the red teamer's toolbox.

Just search "chisel" on https://ippsec.rocks to see how often it's utilised in a pentest type of scenario.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by mike_d on Saturday April 06, 2024 @06:03PM (#39956048)

It is used by red teamers because it is used by attackers.

https://malpedia.caad.fkie.fraunhofer.de/details/win.chisel

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by maxcoder4 on Saturday April 06, 2024 @08:00PM (#39956839)

Well it's used by both because it's pretty useful in attack-like situations.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by arcanemachiner on Saturday April 06, 2024 @08:07PM (#39956879)

Tomato tomahto

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by halJordan on Sunday April 07, 2024 @10:54AM (#39961170)

Tomatoe, tomato. The E at the end of the word generally reflects hardening/lengthening the preceding morpheme (rid, ride; cloth, clothe).

This is a good example of how language evolves because tomahto has not ever been a correct spelling of tomato, and tomatoe is an incorrect spelling derived from making tomato plural into tomatoes and then (incorrectly) dropping just the s to make tomatoes singular again. A mistake based off of a mistake. So while intelligible if incorrect, who's to say if it's wrong?

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by amelius on Saturday April 06, 2024 @02:38PM (#39954432)

That makes it kinda useless.

What we need is a self-updating mechanism. See for instance yt-dlp, which breaks every now and then but a simple update almost always puts you back in action. We need something similar for tunnels.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by Thorrez on Saturday April 06, 2024 @05:44PM (#39955868)

What benefit would a self-updating mechanism provide?

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by globular-toast on Saturday April 06, 2024 @06:24PM (#39956207)

Assuming they mean a cat and mouse game like ytdl where the software is updated once it starts getting detected by the enemy.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by mr_mitm on Sunday April 07, 2024 @02:28AM (#39958623)

How will it self update after it's been deleted by the AV? Also, there are many AVs with different detection strategies. It's not always static analysis that can easily be defeated by slightly changing some lines of code.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by globular-toast on Sunday April 07, 2024 @06:05PM (#39964376)

I was thinking more about it being filtered by firewalls.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by Thorrez on Sunday April 07, 2024 @05:42PM (#39964217)

I don't think Chisel has a goal of evading AV detection.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by passion__desire on Saturday April 06, 2024 @02:22PM (#39954335)

by that you mean, the traffic is suspicious or the binary?

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by magnoliakobus on Saturday April 06, 2024 @03:16PM (#39954687)

Both the protocol tunneling activity and the binary would likely be flagged by most enterprise security software.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by tsimionescu on Sunday April 07, 2024 @01:04AM (#39958304)

Having used this as a part of a solution we were delivering to corporate customers, the traffic wasn't causing problems (we were tunneling over secure WebSockets, though, not plain text ones). It's only those overzealous "malware detection" tools that caused us to have to drop it and come up with a different way of encrypting our traffic.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by halJordan on Sunday April 07, 2024 @10:58AM (#39961199)

The protocol is http(s) so it looks quite generic, are you transiting the GFW? Probably shouldn't be.

[ Parent | on HN ]

Re:Chisel: A fast TCP/UDP tunnel over HTTP by jpillora on Saturday April 06, 2024 @06:34PM (#39956284)

I was tempted to play the cat and mouse AV detection game though decided against it. It’s open source and with effort, one can make it avoid detection, but I’ll leave that up the reader

[ Parent | on HN ]