Hoaxshell

Hoaxshell provides a method to generate and manage Windows reverse shells by leveraging HTTP(S) for communication, mimicking legitimate web traffic to evade detection. It is particularly useful in penetration testing scenarios where traditional shell protocols might be blocked or monitored.

The tool supports both HTTP and HTTPS modes, with options for custom headers, encrypted sessions, and integration with reverse proxies. This makes it suitable for establishing persistent, low-detection reverse shells on target Windows systems.

Key use cases include generating undetectable payloads for initial access, maintaining command and control (C2) over HTTP(S), and handling shell interactions through a Python-based interface.

Hoaxshell operates by generating a Windows payload that establishes a reverse connection to the handler over HTTP(S). The shell session data is transferred via HTTP headers (with customizable names to evade regex-based AV detection). It functions in a beacon-like manner, polling the server at specified frequencies. HTTPS support uses provided certificates for encryption, and options like reverse proxy tunneling (-lt, -ng) enable integration with tools for additional obfuscation.