REDIRECT_URL - the full URL, including protocol, to be set in the Location header.

This function takes two environment variables to be set when deploying: I used to do this with PHP scripts running on a VPS I owned, but now wither serverless I can spin up and deploy arbitrary redirect functions easily. When testing SSRF, being able to control redirects is really useful. These files can then be pulled down from anywhere that has Internet access, or can be embedded inside XSS payloads like this: In any folder containing files you want available online, running now -public will deploy and return a public URL serving up your files: With one command I can serve up any arbitrary file (payload) with a globally trusted TLS certificate (Let’sEncrypt), behind a fast CDN and with full HTTP/2 support. I maintain a few VPSs with valid SSL certificates for this reason, but with serverless static deployments, they’re no longer really necessary. I am often hosting payloads for CSRF or XSS, or needing to put some sort of PoC in a publicly reachable place. Hopefully you can quickly see the benefit of using serverless over VPSs for a lot of these tasks. I’ll go into each of the examples I’m releasing here. Please log in:įollow the instructions in the email and you’re ready to rock. To get started with now, just install the NPM module and set up credentials with an email: Fortunately, there’s no immediate plans to deprecate Now 1.0 anytime soon, so they shouldn’t break. All of my examples require the older Now 1.0. Just recently, Zeit unveiled Now 2.0 which moves away from native Docker deployments. The other main benefit is that full Docker builds are first class deployment units to Now.sh, meaning there’s far less abstraction than AWS Lambda or Google Cloud Functions provide. Their free tier is top-notch, and the command line tool now lets me kick off full deployments right from my terminal. There are several main players in the serverless space (AWS, Google, Microsoft, Cloudflare, etc), but the one I’ve found is the easiest, cheapest (read: free), and most straightfoward is Zeit’s now.sh. Since you don’t control the infrastructure, logging, etc, with serverless, make sure to evaluate the risk before throwing client data around unknown servers Serverless Providers Note: you should always take caution when using infrastructure you don’t own, especially when dealing with sensitive data. I’ve put together some serverless functions that I think are extremely helpful for pentesters, and I’m hoping this post inspires more to take full advantage of “serverless” infrastructure when it comes to security testing.

Over the past few weeks as I’ve explored different serverless providers, I realized a lot of the simple tasks I used VPSs for could be migrated to serverless - where I never have to worry about infrastructure, and (the best part) IT’S FREE.

When I’m in the zone and need something spun up quick, the last thing I want to do is administer a server from scratch. Whether that’s to serve up a payload, listen for an incoming request or just test something from a different IP, it always seemed like such overkill to run a dedicated Ubuntu Server in the cloud to do a single, menial task. When I’m performing pentests or bug bounties, I feel like I’m constantly finding myself spinning up a quick VPS on Digital Ocean to perform a simple task.

Serverless Red Team Infrastructure from MDSec was the first I’d seen serverless used by pentesters, and is really what got me interested in exploring its potential. While I’ve seen a lot of developers embracing serverless, I’ve seen less attention given to it from the security community. Yes, there is still a server/kitchen somewhere, but when I’m developing/eating I don’t really want to think about it. The next time you try and use the word 'serverless' just remember it's like calling takeout 'kitchenless'.- Kate Pearce May 30, 2017 While the term has always seemed like a bit of a misnomer to me, there’s no denying its benefits. Lately I’ve been playing around a lot with “serverless” deployments. All the examples and documentation are here: Intro I’m releasing some serverless functions that I’ve developed over the past few weeks to help with penetration testing. Serverless is awesome and I can’t believe this stuff is free.

Xee payloads