.. /Cpolar
Star

Install
Phishing

Cpolar is a Chinese SaaS tunneling service, functionally similar to ngrok, that exposes a local HTTP/TCP service through cpolar’s edge nodes. It is one of the most widely used intranet-penetration tools in the Chinese market and is commonly bundled or scripted into tutorials for exposing local development servers, which also makes it a plausible exfiltration/C2 channel for a host reachable from a Chinese network.

Paths:

Resources:

Detections:

Install

  1. Registers the client with the account associated with the given token.

    cpolar authtoken <AUTHTOKEN>
    Use case
    One-time setup before creating tunnels.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

Phishing

  1. Exposes a local HTTP service and prints a randomly generated public URL under a cpolar domain (the random subdomain rotates periodically unless a reserved subdomain is purchased).

    cpolar http <PORT>
    Use case
    Exposing a local service, including a hosted phishing page or payload server, over the internet.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS