Hooking Features

All of the following features describe information that can be included in responses. These sections describe some additional JSON formats and data that can be used to have your responses be tracked within Apfell or cause the creation of additional elements within Apfell (such as files, credentials, artifacts, etc).

You can hook multiple features in a single response because they're all unique. To display something to the user, it should be in the user_outputfield, such as:

{
    "user_output": "Still working",
}

or even
{
    "user_output": "{\"key": \"nested json for user as string\"}"
}

The various styles of output are described in the follow-on pages:

• Download

• Keylog

• Process_List

• Artifacts

• Credentials

• Screencapture

• Load

• P2P Connections

• Spawning Agents

Reserved Keywords

When we talk about Hooking Features in the Action: post_response message of an agent, we're really talking about a specific set of Dictionary key value pairs that have special meaning. All responses from the agent to the Apfell server already have to be in a structured format. Each of the above sections goes into what their reserved keywords mean, but a total list is found below:

• total_chunks

• chunk_num

• full_path

• user_output

• completed

• status

• file_id

• artifacts

• credentials

• window_title

• user

• keystrokes

• edges

Additional JSON

If you don't supply a user_output field, but instead supply additional JSON keywords outside of those specified here, they'll be presented to the user. For example:

{
    "custom": "my info",
    "whaddup": 4,
}

Would be displayed to the user as a single-line JSON string. This has its own uses so that you can return other structured output and leverage Browser Scripts to make the structured output interactive