ORIGINAL REDDIT POST

VPS for cybersecurity testing

Hello, I need a VPS/host that allows malware detonation for PCAP capture, anyone know a provider that doesn't ban this in their ToS? Problem is every mainstream VPS provider (AWS, DigitalOcean, Linode, etc.) explicitly prohibits running malware in their…

Original postr/cybersecurity

Hello, I need a VPS/host that allows malware detonation for PCAP capture, anyone know a provider that doesn't ban this in their ToS? Problem is every mainstream VPS provider (AWS, DigitalOcean, Linode, etc.) explicitly prohibits running malware in their acceptable use policy, and I obviously can't run samples on my personal/work machines either. Looking for: Bare-metal or VPS providers that tolerate malware research (with proper isolation) Existing sandbox services that give you raw PCAP output (not just a report) Or a sane self-hosted setup (air-gapped box, isolated VLAN, etc.) if cloud isn't realistic

Collected discussion

13 comments

u/shoopbedoopwoop

Why not use a virtual machine?

u/khbjaneOP

Isolated network is the part I can do. The problem is the opposite direction. I need the sample to actually reach its real C2 server, otherwise I get a failed DNS lookup and no traffic. Fully isolated means no C2, no beaconing, nothing to capture. What I need is controlled egress, not isolation.

u/khbjaneOP

VM is fine for containing the guest OS. It does not contain the network. Packets still exit the physical NIC with my real source IP, so if the sample starts scanning or spamming, that traffic is attributed to me. The hypervisor boundary does not help with that.

u/khbjaneOP

Snapshots and revert are right and I am using that. But host only networking means no internet, so the malware never contacts its C2. I am collecting PCAP to train a traffic classifier and the classes I am missing are C2 beaconing and exfiltration. Those only exist with live outbound connectivity.

u/troherg

So put it in a vm, make that VMs only network interface go to another VM, and put a pcap capture listening on the second VM. It’s stupid easy to isolate VMs from a network.

u/navr183

Sorry I meant isolated from anything else important/from other LANs. VM on a host machine thats also only used for mal analysis, on its own network completely isolated from your work/home/prod LAN. It's gonna be really hard to find any normal compute that allows malware in their TOS. Likely youd need to opt into specific tooling for mal analysis like ANYRUN or some similiar service but for compute.

u/tarzan1376

Could you not simulate the C2 with INetSim, it will be more work than letting it interact with the live C2 but the response can be emulated. Also what about CAPE sandbox?

u/navr183

Why not set up a isolated network, clean host and run a VM?

u/shoopbedoopwoop

Man there are so many ways you can sort this out (mentioned across the comments). There's also any.run which is purposely built for exactly this.

u/tarzan1376

just setup a host only VM and you can use whatever tools you want, set snapshots for easy recovery, etc. You can even clone the VM, set the IP in host connections on the target and have the other one function as your C2 depending on the malware. vmware workstation/fusion is free and is what I personally use for environments like this.

u/Mrhiddenlotus

Just set up a second VM with a VPN turned on, enable packet forwarding, and route traffic from the VM over the VPN

u/2timetime

With the amount of shit I deal with via DigitalOcean I can assure you they don’t give a shit Fr tho just upload it to triage. They have pcap https://tria.ge

u/Forsythe36

Pretty sure AnyRun has a free sandbox.