Serving Random Payloads with Apache mod_rewrite

As testers, we sometimes rely on traditional trial and error methods to achieve successful outcomes. Phishing attacks are a common type of attack that often require multiple attempts to effectively deploy payloads and establish command and control (C2) operations.

This post explains how to effectively carry out payload trial and error by randomly serving payloads from a single URL using Apache mod_rewrite.

The technique described in this post is more suited for a penetration test, where email phishing campaigns may target an entire organization, rather than for a red team assessment, which involves highly targeted email phishing and meticulous troubleshooting of payload issues. By following the steps below, we can set up an Apache redirector, or configure the server directly, to deliver a random payload from a predefined list of potential payloads using the RewriteMap feature of Apache. This utilizes the randomized plain text functionality of Apache. Apache’s RewriteMap function enables the use of external programs, such as scripts, databases, or text files, to remap requests that Apache serves.

The example frequently cited in the official documentation involves a scenario where a store changes its URL structure from item-1234 to iPhone-7-white. In this case, web administrators can use Apache to serve iPhone-7-white when item-1234 is requested, without needing to modify any hard-coded links.