CloakifyFactory

CloakifyFactory follows a specific workflow to hide data in plain sight:

1. Cloaking: The tool takes a payload file, Base64-encodes it, and then maps the encoded data to a list of strings provided by a cipher (e.g., a list of Pokemon monsters or IP addresses).
2. Transfer: The resulting list of strings is transferred across the network. Because the data looks like a harmless list, it is intended to evade DLP (Data Loss Prevention), MLS (Multi-Level Security) devices, and signature-based malware detection.
3. Decloaking: The recipient uses the same cipher to decode the list of strings back into the Base64 payload, which is then restored to its original file format.

To improve security against frequency analysis, you can add noise (entropy) to the cloaked file using noise generator scripts.

If you cannot run the full CloakifyFactory menu-driven tool, you can use the individual scripts as standalone utilities. This is useful for quick, portable operations on a target's local shell.

• cloakify.py: Used to encode a file into a list of strings.
• decloakify.py: Used to decode a list of strings back into the original file.

If the target system lacks Python, you can use py2exe to create an executable for Windows.

CloakifyFactory is a menu-driven tool used to perform text-based steganography. It transforms any filetype (e.g., .zip, .exe, .xls) into a list of harmless-looking strings by Base64-encoding the payload and applying a chosen cipher. To reverse the process, use the Decloakify option with the same cipher used during cloaking.

Note on Security: Cloakify is not a secure encryption scheme and is vulnerable to frequency analysis. For actual secrecy, encrypt your file before cloaking it. To mitigate frequency analysis, use the 'Add Noise' option to increase entropy.

$ python cloakifyFactory.py

To restore a cloaked file back to its original form, follow these steps in the interactive prompt:

1. Select 'Decloakify a File'.
2. Enter the filename or filepath of the received cloaked file.
3. Enter the filename where you want to save the restored (decloaked) file.
4. Preview the cloaked file to identify which Noise Generator and Cipher were used.
5. If a Noise Generator was used during cloaking, select the matching generator to remove the noise.
6. Select the cipher that was used to cloak the file.

The original file will then be reconstructed.

To degrade frequency analysis attacks, you can add noise to your cloaked payloads using standalone noise generator scripts.

Available Noise Generators:

• prependEmoji.py: Adds a randomized emoji to each line.
• prependID.py: Adds a randomized ID tag to each line.
• prependLatLonCoords.py: Adds randomized LatLong coordinates to each line.
• prependTimestamps.py: Adds timestamps (log file style) to each line.

Workflow for noisy payloads:

1. Cloak the file using a cipher (e.g., pokemonGo).
2. Run a noise script (e.g., prependLatLonCoords.py) to add entropy.
3. Transfer the noisy file.
4. Strip the noise before decloaking. You can use removeNoise.py or standard CLI tools like cut to remove the added prefix.
5. Run decloakify.py on the cleaned file.

Cloakify Factory is an interactive Python-based tool for text-based steganography. It transforms any filetype (e.g., .zip, .exe, .xls) into a list of harmless-looking strings using list-based ciphers.

Requirements:

• Python 2.7.x

To start the interactive guided process, run the script from your terminal:

% ./cloakifyFactory.py

You can extend Cloakify Factory by providing custom ciphers. This is useful for unique exfiltration scenarios where prepackaged ciphers might be too recognizable.

Steps to create a cipher:

1. Create a text file containing a list of at least 66 unique words, phrases, or symbols (Unicode is supported).
2. Randomize the order of the list.
3. Remove all duplicate entries and blank lines.
4. Place the file in the ciphers/ subdirectory of the Cloakify directory.
5. Re-run cloakifyFactory.py; the tool will automatically load the new cipher.

Tip: Always test the cloaking and decloaking process with your new cipher before using it in an operational environment.

To hide a file within a list of strings, follow these steps in the interactive prompt:

1. Select 'Cloakify a File'.
2. Enter the filename or filepath of the payload you want to cloak.
3. Enter the filename you want to use for the resulting cloaked file.
4. Select a cipher from the available list (e.g., PokemonGo Monsters, Top 100 Websites, or MD5 Password Hashes).
5. (Optional) Select a Noise Generator to add entropy and help evade frequency analysis attacks.
6. (Optional) Preview the cloaked file to verify the output.

Security Note: Cloakify is not a secure encryption scheme and is vulnerable to frequency analysis. For high-security needs, encrypt your file before cloaking it, or use the 'Add Noise' option to increase entropy.

CloakifyFactory includes several prepackaged ciphers designed to look like harmless or ignorable lists:

• Amphibians (scientific names)
• Belgian Beers
• Desserts (English, Arabic, Thai, Russian, Hindi, Chinese, Persian, and Muppet/Swedish Chef)
• Emoji
• evadeAV (Smallest cipher space, results in ~3x payload size)
• GeoCoords World Capitals (Lat/Lon)
• GeoCaching Coordinates (with Site Names)
• IPv4 Addresses of Popular Websites
• MD5 Password Hashes (intended as distracting bait)
• PokemonGo Monsters
• Shortened URLs (pointing to Rick Astley's "Never Gonna Give You Up")
• Ski Resorts
• Status Codes (generic)
• Star Trek characters
• Top 100 Websites
• World Beaches
• World Cup Teams