“` – wiki基地

Deadpool Proxy Pool Tool: Enhancing Anonymity and Evasion in Security Operations

In the realm of cybersecurity, particularly during penetration testing and red teaming exercises, maintaining anonymity and evading detection are paramount. Security professionals often encounter scenarios where their IP addresses are blocked due to repetitive requests or suspicious activity, hindering their ability to conduct thorough assessments. This challenge is precisely what the “Deadpool” proxy pool tool, written in Go, aims to address.

What is Deadpool?

Deadpool is a robust and flexible proxy management tool designed to collect, validate, and utilize SOCKS5 proxies in a round-robin fashion for traffic forwarding. Its core purpose is to provide security practitioners with a dynamic pool of high-quality proxies, enabling them to bypass IP-based restrictions and maintain operational continuity.

Key Features and Capabilities:

1. Automated Proxy Collection:
   Deadpool integrates seamlessly with leading network space mapping platforms such as Hunter, Quake, and Fofa. By configuring API keys in its config.toml file, the tool can programmatically query these platforms to discover and fetch available SOCKS5 proxies. This automated collection significantly reduces the manual effort required to source proxies.

2. Local Proxy Import:
   Beyond automated collection, Deadpool offers the flexibility to import existing SOCKS5 proxies. Users can supply a lastData.txt file, where each line contains an IP:PORT entry, allowing for the integration of proxies obtained from other sources.

3. Intelligent Proxy Validation:
   Not all proxies are created equal. Deadpool employs a sophisticated validation mechanism to ensure the quality and liveness of its proxy pool. It performs:

   • Deduplication: Eliminates redundant proxy entries.
   • Liveness Checks: Verifies that proxies are operational by attempting to reach a specified checkURL (e.g., https://www.baidu.com) and confirming the presence of expected checkRspKeywords in the response. This ensures that the proxy not only connects but also allows traffic to legitimate destinations.
   • Geolocate Filtering: A powerful feature that allows users to filter proxies based on their geographic location. By specifying includeKeywords or excludeKeywords for country/region names, security teams can target or avoid proxies from specific geopolitical areas, which is crucial for assessments targeting systems with regional access restrictions.
   • Configurable Parameters: Users can fine-tune validation settings, including the number of maxConcurrentReq for parallel checks and the timeout duration for each validation attempt, optimizing performance for their specific network environment.

4. Round-Robin Traffic Forwarding:
   Once a pool of validated proxies is established, Deadpool utilizes them in a round-robin manner. This means that successive requests will be routed through different proxies from the active pool, effectively distributing traffic and making it harder for target systems to identify and block a single source IP.

5. SOCKS5 Authentication Support:
   For scenarios requiring enhanced security or access to private proxy networks, Deadpool supports SOCKS5 proxy authentication. Users can configure a userName and password in the config.toml to secure the proxy listener, preventing unauthorized usage, especially when deployed on publicly accessible servers.

6. Periodic Tasks:
   To maintain a fresh and effective proxy pool, Deadpool can be configured to perform periodic tasks. This includes scheduled liveness checks of existing proxies in memory and automated fetching of new proxies from configured mapping platforms at defined intervals (e.g., weekly or daily).

Practical Applications in Security Operations:

Deadpool’s capabilities make it an invaluable asset for various security-related tasks:

• Evading IP Bans: During web application penetration tests or vulnerability scanning, frequent requests from a single IP can lead to temporary or permanent bans. Deadpool’s rotating proxy pool mitigates this risk.
• Bypassing Geo-Restrictions: When testing applications or services that implement geographic access controls, the geolocate filtering feature allows testers to source proxies from permitted regions.
• Distributed Scanning: For large-scale assessments, distributing traffic across multiple proxies can enhance the speed and resilience of scanning operations.
• Anonymity for OSINT: While not its primary focus, the tool can also aid in Open Source Intelligence (OSINT) gathering by providing a layer of anonymity.

Configuration and Integration:

Configuration is managed via a straightforward config.toml file, where users can set up API keys for various platforms, define listener IP and port, configure proxy checking logic, and schedule periodic tasks. Deadpool is designed to be easily integrated with other security tools that support SOCKS5 proxy configurations, with examples provided for Burp Suite, Proxifier, and SwitchyOmega.

GitHub Actions for Continuous Proxy Management:
For personal and automated proxy management, Deadpool offers a convenient workflow using GitHub Actions. By importing the repository privately and setting up a schedule.yml workflow, users can automate the process of fetching, validating, and updating their lastData.txt file periodically. This ensures a continuously refreshed proxy pool without manual intervention, while emphasizing the critical importance of keeping API keys secure within a private repository.

Disclaimer and Responsible Use:

It’s crucial to highlight Deadpool’s disclaimer: the tool is intended exclusively for legitimate and authorized enterprise security activities. Users are responsible for ensuring their actions comply with local laws and regulations and that they have obtained necessary authorizations. Misuse of the tool for illegal activities is explicitly disclaimed by its developers.

In conclusion, Deadpool empowers security professionals with a sophisticated, automated, and highly configurable solution for managing SOCKS5 proxy pools. By abstracting the complexities of proxy collection and validation, it allows red teamers and penetration testers to focus on their core objectives, enhancing their ability to conduct effective and evasive security assessments.