What are some common filtering conditions usable with RewriteCond in mod_rewrite?

Common conditions include checking `HTTP_USER_AGENT`, `HTTP_REFERER`, request method, remote IP, or cookies. The article shows filtering by Referer with `RewriteCond "%{HTTP_REFERER}" "test.com" [NC]` to redirect only when the referrer matches. A full list of available variables is documented in Apache mod_rewrite documentation. These conditions allow fine-grained traffic distribution, as highlighted in the [CIA Hive Beacon Infrastructure Replication 2—Implementing HTTPS Traffic Distribution Using Apache mod_rewrite](/news/cia-hive-beacon-infrastructure-replication-2-implementing-https-traffic-distribution-using-apache-mod-rewrite) follow-up.

How can you use mod_rewrite to redirect traffic based on User-Agent?

Use `RewriteCond` to check the `HTTP_USER_AGENT` header and `RewriteRule` to specify the redirection target. For example, `RewriteCond "%{HTTP_USER_AGENT}" "Macintosh; Intel Mac OS X 10_9_3" [NC]` followed by `RewriteRule 1.html 2.html` will redirect requests from that Safari browser to `2.html`. This technique is demonstrated in the article for filtering traffic by client type.

How do you enable Apache mod_rewrite and .htaccess support on a Windows system?

After installing Apache, edit `conf/httpd.conf` to uncomment `LoadModule rewrite_module modules/mod_rewrite.so` to enable mod_rewrite. Then, in the same file, change `AllowOverride None` to `AllowOverride All` for the DocumentRoot directory to allow `.htaccess` files. Finally, place a `.htaccess` file with `RewriteEngine on` and desired rules in the htdocs folder.

What is the purpose of the HTTP traffic distribution technique described in this article?

The technique uses Apache mod_rewrite to replicate the traffic distribution functionality seen in the [CIA Hive Beacon Infrastructure Replication 1 - Using Apache mod_rewrite for HTTP Traffic Distribution](/news/cia-hive-beacon-infrastructure-replication-1-using-apache-mod-rewrite-for-http-traffic-distribution) framework. Legitimate traffic is forwarded to the Honeycomb server, while suspicious or invalid traffic is redirected to a Cover Server, enabling stealthy command-and-control operations.

Apache mod_rewrite for HTTP Traffic Distribution - CIA Hive Replication

0x00 Preface

---

On November 9, 2017, WikiLeaks released a document codenamed Vault8, containing the source code and development documentation for the server remote control tool Hive. The framework diagram in the development documentation shows that Hive supports traffic distribution functionality: if the traffic is valid, it is forwarded to the Honeycomb server; if there are issues with the traffic, it is forwarded to the Cover Server.

This article, solely from a technical research perspective, attempts to use Apache's mod_rewrite module to achieve HTTP traffic distribution and accomplish the same objective.

The marked framework diagram is as follows:

0x00 Preface — technical illustration 1

Previous analysis article:

"CIA Hive Testing Guide - Source Code Acquisition and Brief Analysis"

0x01 Introduction

---

This article will cover the following topics:

Installing and configuring Apache mod_rewrite on Windows systems
Installing and configuring Apache mod_rewrite on Ubuntu systems
Rule configuration techniques and examples
Implement HTTP traffic distribution based on judgment conditions

0x02 Install and configure Apache mod_rewrite on Windows system

---

1. Download Apache

Address:

http://httpd.apache.org/download.cgi

Select the required version, test version Apache 2.4.33, download address:

https://www.apachehaus.com/cgi-bin/download.plx?dli=wUWZ1allWW00kej9iUG5UeJVlUGRVYRdnWzQmW

2. Installation

After extraction, install via command line:

cd \Apace24\bin
httpd -k install

3. Enable mod_rewrite module

Edit file: \Apace24\conf\httpd.conf

Find #LoadModule rewrite_module modules/mod_rewrite.so and remove the #

4. Enable support for .htaccess files

Edit the file: \Apace24\conf\httpd.conf

Locate the following section:

DocumentRoot "${SRVROOT}/htdocs"

#
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important. Please see
# http://httpd.apache.org/docs/2.4/mod/core.html#options
# for more information.
#
Options Indexes FollowSymLinks

#
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
#
AllowOverride All

#
# Controls who can get stuff from this server.
#
Require all granted

Change AllowOverride None to AllowOverride All

5. Write .htaccess file and configure rules

Save path: \Apace24\htdocs\

Test rule: redirect 1.html to 2.html, specific content as follows:

RewriteEngine on
RewriteRule 1.html 2.html

Open with Notepad, save as a file with filename ".htaccess"

Note:

Filename includes quotes ", as shown below

5. Write .htaccess file and configure rules — technical illustration 2

2.html is saved in \Apace24\htdocs\, content as follows:

True page

6. Start Apache service

httpd.exe -k start

7. Test

Access http://127.0.0.1/1.html

Return content True page, indicating the webpage has been redirected to 2.html

8. Supplement

Apache log path is \Apache24\logs

mod_rewrite logs are saved in error.log

File \Apache24\conf\httpd.conf can specify log recording level

0x03 Install and configure Apache mod_rewrite on Ubuntu system

---

1. Download and install

sudo apt-get install apache2

2. Enable the mod_rewrite module

sudo a2enmod rewrite

3. Enable support for .htaccess files

Edit the file: /etc/apache2/apache2.conf

Locate the following section:

Options Indexes FollowSymLinks
AllowOverride None
Require all granted

Change AllowOverride None to AllowOverride All

4. Write the .htaccess file and configure the rules

Save the path as \var\www\html\

The test rule is to redirect 1.html to 2.html, with the specific content as follows:

RewriteEngine on
RewriteRule 1.html 2.html

2.html is saved in \var\www\html\, with the following content:

True page

5. Start the Apache service

sudo /etc/init.d/apache2 restart

6. Test

Visit http:/IP/1.html

The returned content 'True page' indicates that the webpage has been redirected to 2.html

7. Supplement

The log path for Apache is /var/log/apache2/

mod_rewrite logs are saved in error.log

The file /etc/apache2/apache2.conf can specify the log level

0x04 Rule Configuration Tips and Examples

---

1. Redirect all web pages to https://www.baidu.com

The content of the .htaccess file is as follows:

RewriteEngine on
RewriteRule . https://www.baidu.com

2. Filter Request Header

(1) User Agent

Redirect only requests with specific User Agents

Example:

Access 1.html using Safari on Mac and redirect it to 2.html

The content of the .htaccess file is as follows:

RewriteEngine on
RewriteCond "%{HTTP_USER_AGENT}" "Macintosh; Intel Mac OS X 10_9_3" [NC]
RewriteRule 1.html 2.html

Parameter description:

RewriteCond "%{HTTP_USER_AGENT}" "Macintosh; Intel Mac OS X 10_9_3" [NC] represents the condition, checking whether HTTP_USER_AGENT contains the string "Macintosh; Intel Mac OS X 10_9_3" (case-insensitive)

NC: Character comparison, case-insensitive

For detailed parameter descriptions, refer to:

https://httpd.apache.org/docs/current/mod/mod_rewrite.html#rewritecond

1. Testing with curl

Simulating Chrome browser:

curl -A "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36" http://192.168.62.137/1.html

No redirection occurred, as shown in the figure below

(1) User Agent — technical illustration 3

Simulating Mac Safari browser:

curl -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A" http://192.168.62.137/1.html

Web page redirection, obtaining the content of 2.html, as shown in the figure below

(1) User Agent — technical illustration 4

2. Method for modifying User Agent in Chrome browser

Access the page, F12 -> More tools -> Network conditions, select User agent as Safari — Mac

As shown in the figure below

(1) User Agent — technical illustration 5

(2) Referer

Redirect only requests from specific sources

Example:

If the source is test.com, redirect to 2.html when accessing 1.html

RewriteEngine on
RewriteCond "%{HTTP_REFERER}" "test.com" [NC]
RewriteRule 1.html 2.html

Testing with curl:

curl -e "test.com" http://192.168.62.137/1.html

(3) Other available filtering conditions

As shown in the figure below

(3) Other available filtering conditions — technical illustration 6

Note:

Image source: https://httpd.apache.org/docs/current/mod/mod_rewrite.html#rewritecond

Additional note:

Jeff Dimmock shared insights on configuring rules with mod_rewrite on his blog, which is worth learning. The address is as follows:

https://bluescreenofjeff.com/tags

0x05 Summary

---

This article introduces the methods for installing and configuring Apache mod_rewrite on Windows and Ubuntu systems, shares configuration tips and examples, and achieves HTTP traffic distribution based on request conditions from a technical research perspective.

The next article will cover the implementation of HTTPS traffic distribution.

CIA Hive Beacon Infrastructure Replication 1 - Using Apache mod_rewrite for HTTP Traffic Distribution