pwnSpoof – Create Realistic Spoofed Log

Post Exploitation is the phase in which attacker clear their traces from the owned machine. Logs are been created on the hacked machine, so to clear them is very much essential to hide the identity. But we can generate spoof logs and insert them instead of our logs. We can generate these logs using an automated tool named pwnSpoof. pwnSpoof tool is developed in the Python3 language and it’s able to generate the custom 2000 unique logs as per server name and logs with different IP addresses. Bu using this tool we can create CTF scenarios for training serials.

Note: Make Sure You have Python Installed on your System, as this is a python-based tool. Click to check the Installation process: Python Installation Steps on Linux

Installation of pwnSpoof Tool on Kali Linux OS

Step 1: Use the following command to install the tool in your Kali Linux operating system.

git clone https://github.com/punk-security/pwnspoof.git

Step 2: Now use the following command to move into the directory of the tool. You have to move in the directory in order to run the tool.

cd pwnspoof

Step 3: You are in the directory of the pwnspoof. Now run the tool by using the following command.

python3 pwnspoof.py -h

Working with pwnSpoof Tool on Kali Linux OS

Example 1: IIS Spoof Fake Logs

python3 pwnspoof.py banking –server-fqdn test.php.com –attack-type bruteforce –server-type IIS –out iis.log

In this example, we will try to generate fake IIS logs against a website.

All the logs are been generated and saved in iis.log file.

We have displayed the iis.log file in mousepad text editor.

Example 2: NGINX logs

python3 pwnspoof.py banking –server-fqdn test.php.com –attack-type command_injection –server-type NGINX

In this example, we are specifying the custom server name as NGINX.

We have displayed the generated logs in terminal itself.

Example 3: Attackers IP Address

python3 pwnspoof.py banking –spoofed-attacks 3 –iocs

In this example, we will create spoof logs with different IP addresses so that the logs look impressive.

You can see that fake logs are been created with different IP addresses.