FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. FRP can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.
| Technique | Procedure example |
|---|---|
| T1046 Network Service Discovery |
As part of load balancing FRP can set `healthCheck.type = "tcp"` or `healthCheck.type = "http"` to check service status on specific hosts with TCPing or an HTTP request. |
| T1049 System Network Connections Discovery |
FRP can use a dashboard and U/I to display the status of connections from the FRP client and server. |
| T1059.007 JavaScript |
FRP can support the use of a JSON configuration file. |
| T1071.001 Web Protocols |
FRP has the ability to use HTTP and HTTPS to enable the forwarding of requests for internal services via domain name. |
| T1090 Proxy |
FRP can proxy communications through a server in public IP space to local servers located behind a NAT or firewall. |
| T1090.003 Multi-hop Proxy |
The FRP client can be configured to connect to the server through a proxy. |
| T1095 Non-Application Layer Protocol |
FRP can communicate over TCP, TCP stream multiplexing, KERN Communications Protocol (KCP), QUIC, and UDP. |
| T1572 Protocol Tunneling |
FRP can tunnel SSH and Unix Domain Socket communications over TCP between external nodes and exposed resources behind firewalls or NAT. |
| T1573.001 Symmetric Cryptography |
FRP can use STCP (Secret TCP) with a preshared key to encrypt services exposed to public networks. |
| T1573.002 Asymmetric Cryptography |
FRP can be configured to only accept TLS connections. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
