ligolo-ng

No entries match these filters. Clear filters

1. docs update Oct 3, 2026 · issue 093

   Ligolo-ng v0.8 adds a config file with agent autobind, pre-configured routes, and an experimental HTTP Web API with WebUI⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Pre-assign a known agent to a tunnel interface so it connects and starts routing automatically — no manual session steps required.
   yaml copy

   agent:
     deadbeefcafe:
       autobind: true
       interface: ligolo

   Pre-configure a tunnel interface and its internal CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. so Ligolo-ng creates them the moment a session starts.
   yaml copy

   interface:
     ligolo:
       routes:
         - 10.55.0.0/24

   Enable the experimental Web API with a local listener, a WebUI, and a single user account so you can drive Ligolo-ng over HTTP.
   yaml copy

   web:
     enabled: true
     enableui: true
     listen: 127.0.0.1:8080
     users:
       ligolo: mysecretpassword

   • Adds autobind and interface keys under a per-agent MAC-address stanza in the proxy config file so agents are automatically attached to a named interface on connect without manual session setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds interface and routes keys to the config file so tunnel interfaces and CIDR routes (e.g. 10.55.0.0/24) are pre-provisioned and applied automatically when a tunneling session starts.
   • Persists interface and route changes made via interface_create and route_add commands automatically back to the configuration file.
   • Adds an experimental Web API (web block in config) that exposes all CLI functions over HTTP, controlled by enabled, listen, secret, users, tls, corsallowedorigin, behindreverseproxy, trustedproxies, enableui, logfile, and debug keys.
   • Supports argon2id-hashed user authentication for the Web API; cleartext passwords in the users config key are automatically hashed and rewritten on first start.
   • Adds autobind and interface keys under a per-agent MAC-address stanza in the proxy config file so agents are automatically attached to a named interface on connect without manual session setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds interface and routes keys to the config file so tunnel interfaces and CIDR routes (e.g. 10.55.0.0/24) are pre-provisioned and applied automatically when a tunneling session starts.
   • Adds an experimental Web API (web block in config) that exposes all CLI functions over HTTP, controlled by enabled, listen, secret, users, tls, corsallowedorigin, behindreverseproxy, trustedproxies, enableui, logfile, and debug keys.
   • Supports argon2id-hashed user authentication for the Web API; cleartext passwords in the users config key are automatically hashed and rewritten on first start.

   1 more in Everything

2. docs update Oct 3, 2026 · issue 093

   Ligolo-ng adds experimental bare-metal build for running implants directly on embedded systems without an OS or kernel.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3. docs update Oct 3, 2026 · issue 093

   Ligolo-ng 0.8 adds a WebUI and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for managing agents, tunnels, interfaces, and listeners via browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Enable the Web API and local WebUI so you can manage agents and tunnels from a browser instead of the CLI.
   ligolo-ng.yaml copy

   web:
     enabled: true
     enableui: true
     corsallowedorigin: 'http://127.0.0.1:8080'

   • Enables the Web API and UI by setting web > enabled to true in ligolo-ng.yaml, with the WebUI listening on 127.0.0.1:8080 by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds enableui key in the web section of ligolo-ng.yaml to activate the local WebUI alongside the API.
   • Adds corsallowedorigin key in ligolo-ng.yaml to control which origins are permitted to reach the API.
   • Introduces an Agent page in the WebUI for viewing all connected agents, configuring tunneling, and using autoroute.
   • Introduces an Interfaces page in the WebUI for setting up interfaces and routes.

   +2 more show less

   • Introduces a Listeners page in the WebUI for configuring listeners.
   • Supports deploying the WebUI as a standalone build via ligolo-ng-web or accessing it remotely at webui.ligolo.ng.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Existing ligolo-ng.yaml configurations must be updated to include the new web section settings before upgrading to 0.8.
4. docs update Oct 3, 2026 · issue 093

   Ligolo-ng exposes agent localhost services via hardcoded magic CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. 240.0.0.0/4, enabling direct scans of 127.0.0.1 ports on the remote agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Scan services running on the remote agent's localhost (127.0.0.1) without needing a dedicated port-forward or listener.
   copy

   $ sudo ip route add 240.0.0.1/32 dev ligolo
   nmap 240.0.0.1 -sV

   • Adds a hardcoded magic CIDR 240.0.0.0/4 that transparently redirects traffic routed through the ligolo interface to the connected agent's 127.0.0.1, enabling direct access to the agent's local ports without a separate listener.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

5. docs update Oct 3, 2026 · issue 093

   ligolo-ng agents can now listen as servers via --bind with the proxy connecting using connect_agent⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   When the target host cannot reach your proxy (e.g. outbound traffic is blocked), run the agent in bind mode and then pull the connection from the proxy side.
   copy

   $ # On the target host — agent listens for incoming proxy connections
   ligolo-agent -bind 0.0.0.0:4444
   
   # On the attacker/operator machine — proxy connects to the waiting agent
   ligolo-ng » connect_agent --ip 192.168.1.10:4444

   • Adds --bind [ip:port] argument to ligolo-agent so the agent listens as a server instead of connecting outbound, enabling bind connections from restrictive environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds connect_agent --ip [ip:port] proxy command to initiate a connection from the ligolo-ng proxy to a listening agent.

   2 details in Everything

6. docs update Oct 3, 2026 · issue 093

   ligolo-ng adds listener_add, listener_list, and listener_stop commands to bind ports on agents and redirect traffic to the proxy server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Catch a reverse shell payload that connects back to the agent — redirect the agent-side port to your local netcat listener on the proxy.
   copy

   $ listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4321 --tcp

   Audit all active agent listeners mid-engagement to confirm redirect targets before launching a payload.
   copy

   $ listener_list

   • Adds listener_add --addr <bind> --to <redirect> --tcp command to open a TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. listening socket on the agent and redirect incoming connections to a specified port on the proxy server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds listener_list command to display all currently active listeners, showing agent name, agent listener address, and proxy redirect address.
   • Adds listener_stop <id> command to terminate a running listener by its index.

   3 details in Everything

7. docs update Oct 3, 2026 · issue 093

   ligolo-ng: Adds a YAML configuration file for the proxy (since v0.8), enabling advanced features including agent autobind, pre-configured interfaces and routes, and Web API settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Pin a known agent (by MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet.) to a specific tunnel interface so it reconnects automatically without operator intervention.
   yaml copy

   agent:
     deadbeefcafe:
       autobind: true
       interface: ligolo

   Enable the experimental Web API with WebUI and a pre-shared secret so CI pipelines or dashboards can drive ligolo-ng over HTTP.
   yaml copy

   web:
     enabled: true
     enableui: true
     listen: 127.0.0.1:8080
     secret: 3383861a48e1332583e5d8cd9946d24b98be780e0c64581d693cb4ff50a68a68
     users:
       ligolo: mysecretpassword

   Pre-declare an internal pivot interface and its routes so Ligolo-ng creates them automatically the moment a tunnel session starts.
   yaml copy

   interface:
     ligolosample:
       routes:
         - 10.254.0.0/24
         - 10.255.0.0/24

   • Adds enableui: true config key to expose the ligolo-ng WebUI through the Web API listener.
   • Adds tls config block for the Web API with autocert, selfcert, selfcertdomain, certfile, keyfile, alloweddomains, and enabled sub-keys.

   2 details in Everything

8. docs update Oct 3, 2026 · issue 093

   Ligolo-ng v0.6 adds interface_create, interface_add_route, and certificate_fingerprint CLI commands to the proxy shell⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Create a tun interface from inside the Ligolo-ng proxy shell instead of shelling out to the host OS — useful when you lack a separate terminal or want a repeatable operator workflow.
   copy

   $ ligolo-ng » interface_create --name "evil-cha"

   Verify the self-signed cert fingerprint on the proxy, then have the agent pin to it — eliminates the risk of MITM without needing a CA-signed cert.
   copy

   $ ligolo-ng » certificate_fingerprint
   # Copy the printed fingerprint, then on the target:
   ./agent -connect attacker_c2_server.com:11601 -accept-fingerprint D005527D2683A8F2DB73022FBF23188E064493CFA17D6FCF257E14F4B692E0FC

   Add a route to the agent's internal network directly from the proxy shell, so nmap or rdesktop can reach pivot targets without touching the host routing table manually.
   copy

   $ ligolo-ng » interface_add_route --name evil-cha --route 192.168.2.0/24

   • Adds interface_create --name command to the proxy CLI to create a tun interface without requiring ip tuntap on the host (Ligolo-ng >= v0.6).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds interface_add_route --name --route command to the proxy CLI to configure routing directly from the Ligolo-ng shell without touching host routing tables (>= v0.6).
   • Adds certificate_fingerprint command to print the active TLS certificate fingerprint, enabling agents to connect with -accept-fingerprint instead of skipping verification.
   • Adds -selfcert-domain flag to the proxy to override the default ligolo domain name used when generating self-signed TLS certificates.
   • Supports SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. tunneling for agent connections via --socks ip:port, with credentials via --socks-user and --socks-pass arguments.

   +5 more show less

   • Supports -autocert flag on the proxy to automatically obtain Let's Encrypt certificates when an agent connects.
   • Supports -selfcert flag on the proxy for automatic self-signed TLS certificate generation.
   • Supports -certfile and -keyfile parameters on the proxy to use custom TLS certificates.
   • Supports -ignore-cert flag on the agent to skip all TLS certificate verification (intended for lab/debug environments).
   • Supports tunnel_start --tun command to start tunneling through a named interface from an active agent session.
   • Adds interface_create --name command to the proxy CLI to create a tun interface without requiring ip tuntap on the host (Ligolo-ng >= v0.6).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds interface_add_route --name --route command to the proxy CLI to configure routing directly from the Ligolo-ng shell without touching host routing tables (>= v0.6).
   • Adds certificate_fingerprint command to print the active TLS certificate fingerprint, enabling agents to connect with -accept-fingerprint instead of skipping verification.
   • Supports SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. tunneling for agent connections via --socks ip:port, with credentials via --socks-user and --socks-pass arguments.
   • Supports -autocert flag on the proxy to automatically obtain Let's Encrypt certificates when an agent connects.

   +4 more show less

   • Supports -selfcert flag on the proxy for automatic self-signed TLS certificate generation.
   • Supports -certfile and -keyfile parameters on the proxy to use custom TLS certificates.
   • Supports -ignore-cert flag on the agent to skip all TLS certificate verification (intended for lab/debug environments).
   • Supports tunnel_start --tun command to start tunneling through a named interface from an active agent session.

   1 more in Everything

9. v0.9 Jul 13, 2026 · issue 015

   Ligolo-ng v0.9 adds faster UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. scanning via ICMP, configurable paths, in-flight TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. tuning, cert fingerprint verification, and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. builds.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.9 https://github.com/nicocha30/ligolo-ng.git
   # already have the repo? check out this version:
   $ git checkout v0.9

   • Speeds up UDP port scanning by processing ICMP port-unreachable messages to immediately mark closed ports.
   • Adds configurable paths for the config file, session history, and self-signed certificates.
   • Supports configurable in-flight TCP connection limits for tuning tunnel throughput.
   • Enables bind certificate fingerprint verification to authenticate relay/proxy identity.
   • Ships ARM64 binaries by default.

   5 details in Everything

10. v0.8.3 Feb 15, 2026 · release notes

    ligolo-ng v0.8.3 adds an API listener flag, insecure WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. support, enhanced interface management, and smarter autoroute UI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.3 https://github.com/nicocha30/ligolo-ng.git
    # already have the repo? check out this version:
    $ git checkout v0.8.3

    └──▷ TRY IT
    Bind the proxy API to a specific interface/port — useful when running multiple proxies or restricting API access to a management network.
    copy

    $ ./proxy --api-laddr 127.0.0.1:9090

    • Adds --api-laddr flag to bind the proxy's API listener to a specific address.
    • Supports insecure (plain) WebSocket connections between proxy and agent.
    • Enhanced interface management commands for more granular tunnel and interface control.
    • Improved proxy/agent recovery: better agent reconnection and tunnel management after disconnects.
    • Autoroute UI now displays existing routes for each interface when adding a new route, reducing misconfiguration.

    5 details in Everything

11. v0.8 Apr 25, 2025 · release notes

    Ligolo-ng v0.8 adds a multiplayer web UI, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., daemon mode, auto-bind, autoroute, and remote agent kill across all platforms.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8 https://github.com/nicocha30/ligolo-ng.git
    # already have the repo? check out this version:
    $ git checkout v0.8

    • New REST API and web interface enable multiplayer operator collaboration on shared proxy sessions.
    • New configuration file support persists tunneling and proxy settings across sessions.
    • New daemon mode lets Ligolo-ng run as a background service on Windows, Linux, macOS, and BSD.
    • New auto-bind feature automatically configures tunneling whenever a specific agent connects.
    • New autoroute capability handles route and interface management automatically on Windows, Linux, macOS, and BSD.

    +1 more show less

    • New agent kill command remotely terminates a connected agent.

    6 details in Everything

12. v0.7.2-alpha Prerelease Aug 25, 2024 · release notes

    ligolo-ng v0.7.2-alpha switches agent/proxy serialization from gob to msgpack

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.2-alpha https://github.com/nicocha30/ligolo-ng.git
    # already have the repo? check out this version:
    $ git checkout v0.7.2-alpha

    └──▷ BREAKING ON UPGRADE

    • !Wire protocol changed from gob to msgpack — existing proxy and agent binaries from prior versions are no longer compatible and must both be upgraded together
13. v0.7-alpha Prerelease Aug 4, 2024 · release notes

    ligolo-ng v0.7-alpha adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. tunneling, automatic tunnel recovery, and a new autoroute command.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7-alpha https://github.com/nicocha30/ligolo-ng.git
    # already have the repo? check out this version:
    $ git checkout v0.7-alpha

    └──▷ TRY IT
    Set up all required interfaces and routes automatically instead of running separate interface/route commands.
    copy

    $ ligolo-ng proxy> autoroute

    • Adds WebSocket protocol support for tunneling, including HTTP-proxy support.
    • New automatic tunnel and listener recovery on network loss — sessions resume without manual intervention.
    • New autoroute command that automatically creates tunnel interfaces and routes in one step.

    3 details in Everything

14. v0.6 Jun 22, 2024 · release notes

    v0.6 adds agent bind mode, fingerprint validation, and interface/route creation capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6 https://github.com/nicocha30/ligolo-ng.git
    # already have the repo? check out this version:
    $ git checkout v0.6

    └──▷ USE IT
    Initiate a tunnel using the new agent bind mode where the agent connects to the proxy.
    shell copy

    ligolo-ng agent -bind

    Start a tunnel session using the actual CLI command now aligned with docs.
    shell copy

    ligolo-ng proxy -run
    > tunnel_start interface=tun0

    • Adds agent bind command to allow the Ligolo-ng agent to initiate outbound connections back to the proxy.
    • Adds fingerprint validation (#50) for enhanced connection security between agent and proxy.
    • Enables dynamic TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. interface and route creation during tunnel setup (#59, #60).

    3 details in Everything

15. v0.1 Aug 9, 2021 · release notes

    Initial release of ligolo-ng with -selfcert flag for TLS configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1 https://github.com/nicocha30/ligolo-ng.git
    # already have the repo? check out this version:
    $ git checkout v0.1

    • Adds -selfcert CLI option to automatically generate and use self-signed certificates

    1 detail in Everything