______ __ ______ __ __ __ __ _____ __ __ __ | __ \.-----.--| |______| __ \.---.-.| |--.| |--.|__| |_ ______| \.-----.----.--.--.--------.-----.-----.| |_.---.-.| |_|__|.-----.-----. | <| -__| _ |______| <| _ || _ || _ || | _|______| -- | _ | __| | | | -__| || _| _ || _| || _ | | |___|__||_____|_____| |___|__||___._||_____||_____||__|____| |_____/|_____|____|_____|__|__|__|_____|__|__||____|___._||____|__||_____|__|__| The next few sections will be dedicated to the red rabbit documentation, the sections will be disected by module, eg: (0x0001 is module search) it goes from there from the list above. Another example of how modules will be seperated is by the cloumn number in the chart above where Brute is the second module name, its section will be labeled 0x0002 - BRUTE -, please take your time going through the documentation ALOT of people often forget about documentation then come to the devs confused as to why some dont work, or how the script works and how to use it, so please, when i mean read it i mean READ IT CAREFULLY!






0x0003 Injection and tampering with images/files
this next session will talk about injecting files, images, and interacting with payloads alot of this section is short and does not need exploration or even experience to understand hope it is easy for you.
> inject gif This command belongs to the stegonography segment of red rabbit, this command allows the user to inject a payload into a given GIF image/short video. If the image is not real path, or does not exist there are backend systems to run and generate a customized GIF based on the name that was not found or could not be opened that you inputted as a path. in the example below when you inject your image you are shown whjat you injected, the path to the image, the exif table, and the hex code showing the location of the GIF
RR6: Injecting -> script>alert()script> RR6: Path -> examples2/main.gif RR6: Payload -> Sucess in injection 000AC080 A9 96 2C D9 98 CC 47 98 - 5E E9 88 97 A9 97 A1 69 ..,...G.^......i 000AC090 99 7E E9 8B 5F 39 9A 80 - 89 9A BE 97 95 AA D9 9A .~.._9.......... 000AC0A0 AE F9 9A B0 19 9B B2 39 - 9B B4 59 9B B6 79 9B 68 .......9..Y..y.h 000AC0B0 97 92 B8 B9 9B BC 99 10 - 09 10 02 00 3B 2A 2F 3D ............;*/= 000AC0C0 31 3B 3C 73 63 72 69 70 - 74 3E 61 6C 65 72 74 28 1;script>alert( 000AC0D0 29 3C 2F 73 63 72 69 70 - 74 3E 3B )/script>; ┌─────────────╥────────────────────┬─────────────────────────┐ │ Data Number ║ Data │After DATA EXIF │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║AnimationIterations │ Infinite │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║FileName │ main.gif │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║FrameCount │ 237 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║MIMEType │ image/gif │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║FileAccessDate │2022:05:21 14:38:42-04:00│ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║ColorResolutionDepth│ 8 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║HasColorMap │ Yes │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║Megapixels │ 5.3 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║FileTypeExtension │ gif │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║FileSize │ 688 KiB │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║ExifToolVersion │ 12.30 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║ImageSize │ 10799x492 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║ImageHeight │ 492 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║BackgroundColor │ 0 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║ImageWidth │ 10799 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║FileType │ GIF │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║FilePermissions │ -rw-r--r-- │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║FileModifyDate │2022:05:26 21:19:19-04:00│ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║Duration │ 7.11 s │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║GIFVersion │ 89a │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║BitsPerPixel │ 5 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║Directory │ examples2 │ ├─────────────╫────────────────────┼─────────────────────────┤ │1 ║FileInodeChangeDate │2022:05:26 21:19:19-04:00│ └─────────────╨────────────────────┴─────────────────────────┘

> inject jpg, webp, bmp All of these commands inject jpg inject webp inject bmp all do the same exact thing, inject a payload into an image is the basis of all four of these commands
> inject png This command is apart of the stegonography toolkit and section that red rabbit holds, however this module is very very much different than any of the other stegonography modules and toolkits that red rabbit has in its selection. This image injection module is still being upgraded since it was built on a module written by the authors of the black hat go book, credits to them for such an amazing oppurtinity to inspire my team to look into stegonography and even modify the toolkit they taught us to build that i implimented into the red rabbit project. Currently this module can do a few things such as- -> Inject a simple payload into a PNG image -> Inject a encoded payload into a PNG image -> decode a payload in a PNG image -> Get meta and image information on the PNG image This toolkit also inspired some other things such as stegonography with archives which we will discuss next inject png is just one command however it has a few flags that can be used with it, in order to properly use this command and sucessfully inject your payload into the PNG image you must do a few things like specifying flags, for the most common usage of this script you can run the following Running script without being compiled | sudo go run main.go -i="path/to/image/image.png" -o="output_of_injected_image.png" --payload="some_payloas-02394890234890238904238904238904809342" Running script in binary form sudo ./main -i="path/to/image/image.png" -o="output_of_injected_image.png" --payload="some_payloas-02394890234890238904238904238904809342" example output below of a simple injection being made to a PNG image
[+] Setting: All flags are correct [+] Setting: Modifying Payload | 237823784789234789237489237984278394278934 [+] Setting: Modifying Type | rNDm [+] Setting: Modifying Chunk Size | 0 [+] Setting: Modifying data | [+] Setting: Untouched/Unmodded payload | 32 33 37 38 32 33 37 38 34 37 38 39 32 33 34 37 38 39 32 33 37 34 38 39 32 33 37 39 38 34 32 37 38 33 39 34 32 37 38 39 33 34 [+] Setting: Untouched/Unmodded Byte P | 32 33 37 38 32 33 37 38 34 37 38 39 32 33 34 37 38 39 32 33 37 34 38 39 32 33 37 39 38 34 32 37 38 33 39 34 32 37 38 39 33 34 Stego Module: image has been sucessfully created Stego Module: Payload has properly been injected

> inject payload && inject payloadl && inject payloadul First off im going to start this by saying all three of these commands are the same but they are ran differently such as using different methods to encode the payload or embed the payload into a URL now a simple example of what this does is takes the payload you enter or a list of payloads and will inject it into the header of the URL, not the response header but the head of the URL so your URL will go from http://www.example.com -> http://www.example.com?=%3Cscript%3Ealert%28%29%3C%2Fscript%3E simple payload parsing at its finest, however there are very few ways of doing this such as the other two methods we have. The first command "inject payload" will just ask the user for a URL and a payload then simply parse the URL with the payload the next one which is payloadul will take a list of URL's and parse it with a given payload you tend to input or use, making the output something like this
https://www.google.com?=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E https://www.youtube.com?=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E https://www.hulu.com?=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E
the last and final one "inject payloadl" will take a list of PAYLOADS and parse it into a given URL, an example output of this would be the following below, if your list is wack and not structures properly it may result in a poor output like the following
https://www.example.com?=admin%2F&=administrator%2F&=admin1%2F&=admin2%2F&=admin3%2F&=admin4%2F&=admin5%2F&=usuarios%2F&=usuario%2F&=moderator%2F&=webadmin%2F& =adminarea%2F&=bb-admin%2F&=adminLogin%2F&=admin_area%2F&=panel-administracion%2F&=instadmin%2F&=memberadmin%2F&=administratorlogin%2F&=adm%2F&=admin%2Faccount.php& =admin%2Findex.php&=admin%2Flogin.php&=admin%2Fadmin.php&=admin_area%2Fadmin.php&=admin_area%2Flogin.php&=siteadmin%2Flogin.php&=siteadmin%2Findex.php&=siteadmin%2F login.html&=admin%2Faccount.html&=admin%2Findex.html&=admin%2Flogin.html&=admin%2Fadmin.html&=admin_area%2Findex.php&=bb-admin%2Findex.php&=bb-admin%2Flogin.php&=bb-a dmin%2Fadmin.php&=admin%2Fhome.php&=admin_area%2Flogin.html&=admin_area%2Findex.html&=admin%2Fcontrolpanel.php&=admin.php&=admincp%2Findex.asp&=admincp%2Flogin.asp&= admincp%2Findex.html&=adminpanel.html&=webadmin.html&=webadmin%2Findex.html&=webadmin%2Fadmin.html&=webadmin%2Flogin.html&=admin%2Fadmin_login.html&=admin_login.html& =panel-administracion%2Flogin.html&=admin%2Fcp.php&=cp.php&=administrator%2Findex.php&=administrator%2Flogin.php&=nsw%2Fadmin%2Flogin.php&=webadmin%2Flogin.php&=admin% 2Fadmin_login.php&=admin_login.php&=administrator%2Faccount.php&=administrator.php&=admin_area%2Fadmin.html&=pages%2Fadmin%2Fadmin-login.php