T1119 Data Collection Components

This directory contains two complementary components for data collection:

1. cf-collect - Cloudflare Worker for traffic redirection
2. collect.js - Express-based collection server

Both components work together to implement the data collection infrastructure for the T1119 technique demonstration, but can also be used independently.

Component 1: cf-collect Cloudflare Worker

The Cloudflare Worker acts as a traffic redirector that forwards all incoming requests to https://attck-deploy.net/attcks/T1119/collect.

Purpose

The worker serves as a middle layer that can:

• Log and forward incoming traffic
• Preserve request metadata and payloads
• Maintain the original request methods, headers, and body content
• Create an additional layer of obfuscation for collection activities

Deployment

To deploy this worker to Cloudflare:

1. Install Wrangler CLI: npm install -g wrangler
2. Authenticate: wrangler login
3. Test locally: wrangler dev
4. Deploy: wrangler publish

Configuration