.. /wstunnel
Star

Access

wstunnel tunnels TCP or UDP traffic over WebSocket or HTTP2 to an operator-run wstunnel server, blending tunneled traffic with ordinary web traffic to bypass firewalls and DPI. Because the server is self-hosted, there is no vendor domain to block. It has been observed in intrusions by Scattered Spider/UNC3944 and Octo Tempest, and in the China-aligned Shadow-Earth-053 espionage campaign.

Paths:

Resources:

Detections:

Access

  1. Starts the operator-controlled wstunnel server, accepting client tunnels over WebSocket Secure.

    wstunnel server wss://0.0.0.0:8080
    Use case
    Standing up the WebSocket tunnel endpoint that compromised hosts connect to.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Connects to the wstunnel server over WebSocket and exposes a local SOCKS5 proxy, routing traffic into the tunnel to bypass firewalls and DPI.

    wstunnel client -L socks5://127.0.0.1:1080 wss://<SERVER>:8080
    Use case
    Establishing a SOCKS pivot tunneled over WebSocket.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. Forwards a local TCP port over the WebSocket tunnel to a remote service such as SSH, reaching it through the operator-controlled server.

    wstunnel client -L tcp://2222:127.0.0.1:22 wss://<SERVER>:8080
    Use case
    Reaching an internal service through a WebSocket tunnel.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS