Exploit Server Iolite

A powerful, feature-rich exploit server built in Go with TLS encryption, web interface, and advanced security testing capabilities. Designed for penetration testing, security research, and educational purposes.

✨ Features

Core Functionality

• 🔒 TLS/HTTPS Support - End-to-end encryption with configurable certificates
• 🎯 HTTP Response Crafting - Create custom HTTP responses with full control over headers, status codes, and content
• 🔄 MITM Proxy - Man-in-the-middle request forwarding and inspection
• 📊 Real-time Logging - Live request monitoring with WebSocket updates
• 🔐 AES Encryption - Request logging with AES-128/192/256 encryption
• 🌐 Web Interface - Modern, responsive UI for all operations

Advanced Capabilities

• Custom HTTP Methods - Support for standard and custom HTTP methods
• Header Manipulation - Full control over HTTP headers and response crafting
• WebSocket Support - Real-time communication for live updates
• Docker Ready - Containerized deployment with Docker and Docker Compose
• OpenShift Compatible - Enterprise deployment templates included
• Certificate Management - Automated certificate generation scripts

🚀 Quick Start

Prerequisites

• Go 1.21+ for development
• Docker for containerized deployment

Option 1: Development (HTTP)

# Clone the repository
git clone https://github.com/AmadeusITGroup/exploit-server.git
cd exploit-server

# Install dependencies
go mod download

# Run the server (HTTP on port 8080)
# Note: Uses default encryption key with warning message
go run cmd/iolite/main.go

# Optionally set custom encryption key to avoid warning
# export EXPLOIT_SERVER_KEY=your32characterencryptionkey1234

Option 2: Production with TLS (HTTPS)

# Set environment variables with TLS certificates
export EXPLOIT_SERVER_KEY=your32characterencryptionkey1234
export EXPLOIT_SERVER_CERT_FILE=/path/to/your/certificate.crt
export EXPLOIT_SERVER_KEY_FILE=/path/to/your/private.key
# Run the server (HTTPS on port 8443)
go run cmd/iolite/main.go

🌐 Access Points

Development Mode (HTTP)

When running without TLS certificates:

• Main Interface: http://localhost:8080
• Response Crafting: http://localhost:8080/craft
• MITM Interface: http://localhost:8080/mitm
• Request Logs: http://localhost:8080/logs

Production Mode (HTTPS)

When running with TLS certificates:

• Main Interface: https://localhost:8443
• Response Crafting: https://localhost:8443/craft
• MITM Interface: https://localhost:8443/mitm
• Request Logs: https://localhost:8443/logs

📖 Usage Guide

HTTP Response Crafting

The /craft endpoint provides a web interface for creating custom HTTP responses:

1. Configure Response Parameters:

   • URL path to intercept
   • HTTP method (GET, POST, etc.)
   • HTTP version and status code
   • Custom headers (copy-pastable format)
   • Response body content

2. Save and Test:

   • Responses are stored in memory
   • Incoming requests matching URL and method return crafted responses
   • Multiple responses can be configured simultaneously

MITM Proxy

The /mitm endpoint enables man-in-the-middle request forwarding:

1. Configure Target:

   • Set target URL for request forwarding
   • All matching requests are proxied to the target
   • Responses are forwarded back to the original client

2. Monitor Traffic:

   • View real-time request/response data
   • Inspect headers, body content, and timing

Request Logging

The /logs endpoint provides comprehensive request monitoring:

• Real-time Updates: WebSocket-based live request monitoring
• Encrypted Storage: All request data encrypted with AES
• Detailed Information: Method, path, headers, body, and timestamps
• Export Capabilities: JSON API for programmatic access

⚙️ Configuration

Environment Variables

Variable	Description	Required	Default
EXPLOIT_SERVER_KEY	AES encryption key (16, 24, or 32 chars)	❌	1234567890123456
EXPLOIT_SERVER_CERT_FILE	Path to TLS certificate	❌	-
EXPLOIT_SERVER_KEY_FILE	Path to TLS private key	❌	-
EXPLOIT_SERVER_PORT	Server port	❌	8443 (HTTPS) / 8080 (HTTP)

TLS Configuration

Development: TLS certificates are optional. When not provided, the server runs on HTTP (port 8080) for easy development.

Production: For secure deployment, provide both certificate and key files to enable HTTPS (port 8443).

# Production example with proper certificates
export EXPLOIT_SERVER_CERT_FILE=/etc/ssl/certs/server.crt
export EXPLOIT_SERVER_KEY_FILE=/etc/ssl/private/server.key

Encryption Key Configuration

The server includes a default encryption key (1234567890123456) for development and deployment convenience. This allows the application to run immediately without configuration, but should be changed for production use.

Development: The default key is acceptable for testing and development purposes.

Production: Always use a strong, unique 32-character encryption key:

export EXPLOIT_SERVER_KEY=your_strong_32_character_key_here

🏗️ API Reference

Crafted Responses API

• GET /api/craft - List all crafted responses
• POST /api/craft - Create new crafted response
• DELETE /api/craft - Delete crafted response(s)

MITM API

• GET /api/mitm - Get current MITM configuration
• POST /api/mitm - Set MITM target URL
• DELETE /api/mitm - Clear MITM configuration

Logging API

• GET /api/logs - Get encrypted request logs
• WebSocket /ws - Real-time log updates

🔒 Security Considerations

Development vs Production

Development:

• Self-signed certificates are acceptable
• Default encryption keys for testing
• Local network access only

Production:

• Use certificates from trusted Certificate Authority
• Strong, unique 32-character encryption keys
• Implement proper network security controls
• Regular security updates and monitoring

Best Practices

1. TLS Configuration:

   • Use HTTP for development and testing
   • Enable HTTPS with proper certificates for production
   • Regularly rotate certificates in production environments

2. Encryption Keys:

   • Use cryptographically secure random keys
   • Never share keys in version control
   • Unique keys per deployment

3. Network Security:

   • Implement firewall rules
   • Use VPN for remote access
   • Monitor for suspicious activity

4. Access Control:

   • Restrict server access to authorized users
   • Implement authentication for sensitive operations
   • Regular access reviews

🛠️ Development

Project Structure

exploit-server-iolite/
├── cmd/iolite/           # Application entry point
├── pkg/api/              # Core API handlers
│   ├── serve.go          # HTTP server and routing
│   ├── craft.go          # Response crafting logic
│   ├── mitm.go           # MITM proxy functionality
│   ├── log.go            # Request logging and WebSocket
│   └── utilsApi.go       # Encryption utilities
├── web/http/             # Web interface files
│   ├── craft.html        # Response crafting UI
│   ├── mitm.html         # MITM interface
│   ├── logs.html         # Log viewing interface
│   └── *.js              # Frontend JavaScript
└── Dockerfile            # Container image for OpenShift deployment

Building from Source

# Clone repository
git clone https://github.com/AmadeusITGroup/exploit-server.git
cd exploit-server

# Download dependencies
go mod download

# Build binary
go build -o iolite ./cmd/iolite

# Run for development (HTTP)
export EXPLOIT_SERVER_KEY=your32characterencryptionkey1234
./iolite

# Run tests
go test ./...

Dependencies

• Gorilla WebSocket: Real-time communication
• Go Standard Library: HTTP server, TLS, encryption

🔧 Troubleshooting

Common Issues

Connection Issues:

# Check if server is listening (HTTP development)
netstat -tlnp | grep 8080

# Check if server is listening (HTTPS production)
netstat -tlnp | grep 8443

# Test HTTP connectivity (development)
curl http://localhost:8080

# Test HTTPS connectivity (production)
curl -k https://localhost:8443

Certificate Issues (Production only):

# Verify certificate validity
openssl x509 -in /path/to/server.crt -text -noout

# Check certificate file permissions
ls -la /path/to/certificates/

Encryption Key Issues:

# Verify key length
echo -n "your-key-here" | wc -c

📚 Use Cases

Penetration Testing

• Test application response to various HTTP inputs
• Simulate malicious server responses
• Analyze client-side vulnerability handling

🤝 Contributing

Contributions are welcome! Please feel free to submit pull requests, report bugs, or suggest new features.

Development Guidelines

1. Follow Go coding standards
2. Update documentation as needed
3. Ensure security best practices

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

⚠️ Disclaimer

This tool is intended for educational purposes, authorized penetration testing, and security research only. Users are responsible for ensuring compliance with applicable laws and regulations. The authors are not responsible for any misuse of this software.

🔗 Support

For questions, issues, or feature requests:

• Open an issue in the repository
• Check existing documentation
• Review troubleshooting section

---

Note: Always use this tool responsibly and in accordance with applicable laws and organizational policies.