.. /Zrok
Star

Install
Phishing
Exfiltration
Access

Zrok is a sharing-as-a-service tool built on OpenZiti, a zero-trust network overlay. A single command publishes a local web service, file share or private TCP/UDP endpoint through the zrok.io service (or a self-hosted instance), without any firewall or port-forwarding changes on the host.

Paths:

Resources:

Detections:

Install

  1. Links the local environment to a zrok account using an invite/enable token.

    zrok enable <TOKEN>
    Use case
    One-time setup before sharing.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

Phishing

  1. Publishes a local web service to the internet via zrok.io and prints the resulting public URL.

    zrok share public localhost:<PORT>
    Use case
    Exposing a local service, including a hosted phishing page or payload server.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

Exfiltration

  1. Publishes a local directory as a shareable network drive.

    zrok share public --backend-mode drive <LOCAL_DIRECTORY>
    Use case
    Exfiltrating a directory of files by exposing it for download.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

Access

  1. Shares a TCP/UDP service privately with other zrok identities, without public internet exposure.

    zrok share private localhost:<PORT>
    Use case
    Reaching an internal service from another zrok-enabled host under the operator's control.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS