VPS for cybersecurity testing
Hello, I need a VPS/host that allows malware detonation for PCAP capture, anyone know a provider that doesn't ban this in their ToS? Problem is every mainstream VPS provider (AWS, DigitalOcean, Linode, etc.) explicitly prohibits running malware in their…
Hello, I need a VPS/host that allows malware detonation for PCAP capture, anyone know a provider that doesn't ban this in their ToS? Problem is every mainstream VPS provider (AWS, DigitalOcean, Linode, etc.) explicitly prohibits running malware in their acceptable use policy, and I obviously can't run samples on my personal/work machines either. Looking for: Bare-metal or VPS providers that tolerate malware research (with proper isolation) Existing sandbox services that give you raw PCAP output (not just a report) Or a sane self-hosted setup (air-gapped box, isolated VLAN, etc.) if cloud isn't realistic
Collected discussion
Why not use a virtual machine?
Isolated network is the part I can do. The problem is the opposite direction. I need the sample to actually reach its real C2 server, otherwise I get a failed DNS lookup and no traffic. Fully isolated means no C2, no beaconing, nothing to capture. What I need is controlled egress, not isolation.
VM is fine for containing the guest OS. It does not contain the network. Packets still exit the physical NIC with my real source IP, so if the sample starts scanning or spamming, that traffic is attributed to me. The hypervisor boundary does not help with that.
Snapshots and revert are right and I am using that. But host only networking means no internet, so the malware never contacts its C2. I am collecting PCAP to train a traffic classifier and the classes I am missing are C2 beaconing and exfiltration. Those only exist with live outbound connectivity.
So put it in a vm, make that VMs only network interface go to another VM, and put a pcap capture listening on the second VM. It’s stupid easy to isolate VMs from a network.
Sorry I meant isolated from anything else important/from other LANs. VM on a host machine thats also only used for mal analysis, on its own network completely isolated from your work/home/prod LAN. It's gonna be really hard to find any normal compute that allows malware in their TOS. Likely youd need to opt into specific tooling for mal analysis like ANYRUN or some similiar service but for compute.
Could you not simulate the C2 with INetSim, it will be more work than letting it interact with the live C2 but the response can be emulated. Also what about CAPE sandbox?
Why not set up a isolated network, clean host and run a VM?
Man there are so many ways you can sort this out (mentioned across the comments). There's also any.run which is purposely built for exactly this.
just setup a host only VM and you can use whatever tools you want, set snapshots for easy recovery, etc. You can even clone the VM, set the IP in host connections on the target and have the other one function as your C2 depending on the malware. vmware workstation/fusion is free and is what I personally use for environments like this.
Just set up a second VM with a VPN turned on, enable packet forwarding, and route traffic from the VM over the VPN
With the amount of shit I deal with via DigitalOcean I can assure you they don’t give a shit Fr tho just upload it to triage. They have pcap https://tria.ge
Pretty sure AnyRun has a free sandbox.