# Setting Up Your Testing Appliance

# Test Connectivity

# SSH Access

SSH into the appliance from your terminal. Replace username with your UPN (email address before the @) and appliance-ssh with the subdomain you are given. If you cannot connect, ensure you have setup cloudflared on your workstation as described previously. If you still cannot connect, ask a manager to check the status of the tunnel.

ssh [email protected]

# Web Filtering

Once you have SSH access, run a few commands to get an idea of what web filtering is in place. A good place to start is a simple apt update. If you see errors indicating the repos are blocked, there is probably strict web filtering in place. This is common in larger organizations and will make it more difficult to download new tools.

If you need to remedy this, you can use our proxy server in AWS. You cannot conenct directly to the proxy server as its proxy ports are not open to the internet. Even if our proxy server was public, the client probably has strict egress filtering that will block the outbound connection from our appliance. Instead, we will SSH into the proxy and from there, ssh (via cloudflared) directly into the testing appliance. Instead of using the SSH session to run commands, we will use the session to forward a local port on the appliance back to the proxy server.

#TODO pending setup of new proxy server

That connection will run in the background on the proxy server. You can safely exit the proxy server.

#TODO add instructions on how to verify tunnel is online and configure proxychains.

# Load the IPs and exclusions

Create two files in /root/ named scope-include and scope-exclude. Copy the in-scope IPs/subnets into scope-include and the excluded IPs/subnets into scope-exclude. There should be one entry per line.

Feel free to create additional files if you want to break up the in-scope networks into groups, for example different branches or locations. This can be helpful if you want to target certain groups specifically. However, the scope-include file should have ALL in-scope IPs/subnets.

Run the scope-rules.py script. It will expect the scope-exclude file to in /root. You will see confirmation that firewall rules have been created. These rules block all outgoing traffic to those restricted hosts.