Cloud Function Proxy

Use Serverless cloud functions to implement probing capabilities for various scanners, with the goal of bypassing situational awareness platforms, WAFs, and other security devices, increasing the difficulty for blue-team analysts to trace traffic, and achieving an effect where blocking and investigation become much harder.

What is a cloud function?

A cloud function (Serverless Cloud Function, SCF) is a serverless execution environment provided by cloud computing vendors for enterprises and developers. It can run code without requiring users to purchase or manage servers, and is an ideal computing platform for scenarios such as real-time file processing and data processing. You only need to write the core code in a language supported by the SCF platform and set the conditions for code execution, and the code can run elastically and securely on a cloud infrastructure.

Why proxy IPs through cloud functions? (cheap)

This is because cloud functions are automatically deployed across multiple availability zones in the same region. When requesting a target, they automatically call IP addresses from different availability zones. As a result, the request IP changes each time, which achieves the goal of building a proxy pool.

Environment Preparation

Cloud function vendor: Tencent Cloud

Repository used: https://github.com/shimmeris/SCFProxy/

Configure the cloud key. Tencent Cloud is used for this demonstration.

scfproxy && vim ~/.confg/scfproxy/sdk.toml

View available regions

./scfproxy list region -p tencent

Deploy

Choose one of the available regions listed above and create it.

./scfproxy deploy http -p tencent -r ap-shanghai

Check whether creation was successful.

./scfproxy list http

Run

On the first run, the scfproxy.cer and scfproxy.key certificates are generated in the ~/.confg/scfproxy/cert directory. They must be imported into the system certificate store and trusted before HTTPS requests can be proxied.

The -l address format is ip:port. The IP can be omitted and deployed in the form :port, which is equivalent to 0.0.0.0:port.

When the HTTP proxy runs, it reads records from ~/.config/scfproxy/http.json. If multiple deployed cloud functions exist, regardless of vendor, each HTTP request randomly selects one of them for proxying.

./scfproxy http -l 0.0.0.0:8787
# -l address` 格式为 `ip:port`，可省略 ip 使用 `:port` 形式进行部署，效果等同于 `0.0.0.0:port

Effect