        ● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
      

Multi-protocol network egress assessment and DLP verification framework featuring automated L4 sweeps, corporate proxy traversal, and covert protocol smuggling across 20+ channels.

$ git clone https://shehzade.io/repos/contraband.git Copy

Source ZIP (1.93 MB)

Code 174 Commits 1

← Back to directory

2.5 KB

Raw

Contraband Operator Wiki

Welcome to the Contraband technical reference and operator wiki. Contraband is a pure Go (CGO_ENABLED=0) egress assessment engine designed for authorized red teams, purple teams, and network defenders to evaluate perimeter filtering, corporate proxy enforcement, and Data Loss Prevention (DLP) controls.

DIAGRAM // MERMAID

flowchart LR
    Client["Contraband Client<br/>(L4 Sweep + Evasion + DLP)"] --> Proxy["Corporate Proxy / NGFW / CASB<br/>(Direct, PAC, NTLM/Kerberos)"]
    Proxy --> Server["Contraband Server<br/>(Reflection + L7 Listeners)"]
    Server --> Hub["LiveHub Telemetry Engine"]
    Hub --> Dashboard["Web Dashboard (:8080)<br/>(Real-Time SSE + Telemetry)"]
    Client -.->|"--sync-report"| Hub

flowchart LR
    Client["Contraband Client<br/>(L4 Sweep + Evasion + DLP)"] --> Proxy["Corporate Proxy / NGFW / CASB<br/>(Direct, PAC, NTLM/Kerberos)"]
    Proxy --> Server["Contraband Server<br/>(Reflection + L7 Listeners)"]
    Server --> Hub["LiveHub Telemetry Engine"]
    Hub --> Dashboard["Web Dashboard (:8080)<br/>(Real-Time SSE + Telemetry)"]
    Client -.->|"--sync-report"| Hub

Document	Description
Installation and Build	Cross-compilation matrix for Linux, macOS, and Windows across AMD64/ARM64.
Quickstart Guide	30-second operational execution guides for standalone and unified binaries.
Protocols Reference	Detailed breakdown of all 20+ supported L4, L7, DNS, SMB, Cloud, and Covert egress protocols.
Proxy Traversal and Evasion	PAC discovery, NTLM/Kerberos authentication, uTLS fingerprint mimicry, and traffic pacing.
Synthetic DLP Verification	Mathematical specifications for Luhn PCI-DSS cards, SSN/NINO/SIN, HL7/FHIR, and cloud API keys.
Command Center HUD	Real-time SSE event bus, telemetry metrics schema, zero-CDN web dashboard, and report ingestion.
Soak Testing and Benchmarks	3.18 TB continuous soak test results, memory invariant (<32MB), and hardware sizing guidelines.

Core Operational Invariants

Invariant	Specification	Guarantee
Runtime Independence	Pure Go (`CGO_ENABLED=0`)	Compiles to static single-file binaries with no libc, python, or external library requirements.
Bounded Memory	Deterministic `<32 MB` Heap	Streaming iterators and pooled buffers prevent heap exhaustion regardless of transfer size (50 KB to 10 TB).
Port Non-Interference	Probe before binding	Listeners verify port availability; active system services are skipped without disruption.
Measurement Precision	Sub-millisecond timing	L4 sweeps, proxy handshakes, and L7 chunk ACKs record duration with millisecond precision (`0.00ms`).

1	# Contraband Operator Wiki
2
3	Welcome to the Contraband technical reference and operator wiki. Contraband is a pure Go (`CGO_ENABLED=0`) egress assessment engine designed for authorized red teams, purple teams, and network defenders to evaluate perimeter filtering, corporate proxy enforcement, and Data Loss Prevention (DLP) controls.
4
5	```mermaid
6	flowchart LR
7	Client["Contraband Client<br/>(L4 Sweep + Evasion + DLP)"] --> Proxy["Corporate Proxy / NGFW / CASB<br/>(Direct, PAC, NTLM/Kerberos)"]
8	Proxy --> Server["Contraband Server<br/>(Reflection + L7 Listeners)"]
9	Server --> Hub["LiveHub Telemetry Engine"]
10	Hub --> Dashboard["Web Dashboard (:8080)<br/>(Real-Time SSE + Telemetry)"]
11	Client -.->\|"--sync-report"\| Hub
12	```
13
14	---
15
16	## Wiki Navigation Index
17
18	\| Document \| Description \|
19	\| :--- \| :--- \|
20	\| [Installation and Build](Installation-and-Build.md) \| Cross-compilation matrix for Linux, macOS, and Windows across AMD64/ARM64. \|
21	\| [Quickstart Guide](Quickstart-Guide.md) \| 30-second operational execution guides for standalone and unified binaries. \|
22	\| [Protocols Reference](Protocols-Reference.md) \| Detailed breakdown of all 20+ supported L4, L7, DNS, SMB, Cloud, and Covert egress protocols. \|
23	\| [Proxy Traversal and Evasion](Proxy-Traversal-and-Evasion.md) \| PAC discovery, NTLM/Kerberos authentication, uTLS fingerprint mimicry, and traffic pacing. \|
24	\| [Synthetic DLP Verification](Synthetic-DLP-Verification.md) \| Mathematical specifications for Luhn PCI-DSS cards, SSN/NINO/SIN, HL7/FHIR, and cloud API keys. \|
25	\| [Command Center HUD](Command-Center-HUD.md) \| Real-time SSE event bus, telemetry metrics schema, zero-CDN web dashboard, and report ingestion. \|
26	\| [Soak Testing and Benchmarks](Soak-Testing-and-Benchmarks.md) \| 3.18 TB continuous soak test results, memory invariant (<32MB), and hardware sizing guidelines. \|
27
28	---
29
30	## Core Operational Invariants
31
32	\| Invariant \| Specification \| Guarantee \|
33	\| :--- \| :--- \| :--- \|
34	\| Runtime Independence \| Pure Go (`CGO_ENABLED=0`) \| Compiles to static single-file binaries with no libc, python, or external library requirements. \|
35	\| Bounded Memory \| Deterministic `<32 MB` Heap \| Streaming iterators and pooled buffers prevent heap exhaustion regardless of transfer size (50 KB to 10 TB). \|
36	\| Port Non-Interference \| Probe before binding \| Listeners verify port availability; active system services are skipped without disruption. \|
37	\| Measurement Precision \| Sub-millisecond timing \| L4 sweeps, proxy handshakes, and L7 chunk ACKs record duration with millisecond precision (`0.00ms`). \|

# Contraband Operator Wiki

Welcome to the **Contraband** technical reference and operator wiki. Contraband is a pure Go (`CGO_ENABLED=0`) egress assessment engine designed for authorized red teams, purple teams, and network defenders to evaluate perimeter filtering, corporate proxy enforcement, and Data Loss Prevention (DLP) controls.

```mermaid
flowchart LR
    Client["Contraband Client<br/>(L4 Sweep + Evasion + DLP)"] --> Proxy["Corporate Proxy / NGFW / CASB<br/>(Direct, PAC, NTLM/Kerberos)"]
    Proxy --> Server["Contraband Server<br/>(Reflection + L7 Listeners)"]
    Server --> Hub["LiveHub Telemetry Engine"]
    Hub --> Dashboard["Web Dashboard (:8080)<br/>(Real-Time SSE + Telemetry)"]
    Client -.->|"--sync-report"| Hub
```

---

## Wiki Navigation Index

| Document | Description |
| :--- | :--- |
| **[Installation and Build](Installation-and-Build.md)** | Cross-compilation matrix for Linux, macOS, and Windows across AMD64/ARM64. |
| **[Quickstart Guide](Quickstart-Guide.md)** | 30-second operational execution guides for standalone and unified binaries. |
| **[Protocols Reference](Protocols-Reference.md)** | Detailed breakdown of all 20+ supported L4, L7, DNS, SMB, Cloud, and Covert egress protocols. |
| **[Proxy Traversal and Evasion](Proxy-Traversal-and-Evasion.md)** | PAC discovery, NTLM/Kerberos authentication, uTLS fingerprint mimicry, and traffic pacing. |
| **[Synthetic DLP Verification](Synthetic-DLP-Verification.md)** | Mathematical specifications for Luhn PCI-DSS cards, SSN/NINO/SIN, HL7/FHIR, and cloud API keys. |
| **[Command Center HUD](Command-Center-HUD.md)** | Real-time SSE event bus, telemetry metrics schema, zero-CDN web dashboard, and report ingestion. |
| **[Soak Testing and Benchmarks](Soak-Testing-and-Benchmarks.md)** | 3.18 TB continuous soak test results, memory invariant (<32MB), and hardware sizing guidelines. |

---

## Core Operational Invariants

| Invariant | Specification | Guarantee |
| :--- | :--- | :--- |
| Runtime Independence | Pure Go (`CGO_ENABLED=0`) | Compiles to static single-file binaries with no libc, python, or external library requirements. |
| Bounded Memory | Deterministic `<32 MB` Heap | Streaming iterators and pooled buffers prevent heap exhaustion regardless of transfer size (50 KB to 10 TB). |
| Port Non-Interference | Probe before binding | Listeners verify port availability; active system services are skipped without disruption. |
| Measurement Precision | Sub-millisecond timing | L4 sweeps, proxy handshakes, and L7 chunk ACKs record duration with millisecond precision (`0.00ms`). |