Deploy Remote Access on a VPS

Deploy Remote Access on a VPS

Run XHack on a server and you can reach the agent from your phone or laptop at any time through one permanent link, with nothing on the network to configure.

About ten minutes, start to finish.

Read this before you begin

The agent is an offensive security tool. Remote Access makes it reachable from any browser that has your link and your web console password. Treat that seriously.

• Run it at your own risk. Only point it at targets you have written permission to test.
• Use a spare, throwaway server. A container or a cheap VPS you can destroy afterwards. Never a machine that matters to you, and never one sitting beside production services or customer data.
• Treat the web console login like a root password. Long, unique, in a password manager, never reused.
• Rotate it after every engagement, and the moment you suspect it leaked.
• Tear it down when you are done. Stop Remote Access, uninstall the service, destroy the server.

What you need

• A Linux VPS you control, with SSH access. A small one is plenty.
• A target you are authorised to test.
• An active paid XHack plan. Trials cannot use Remote Access.

1. Install the agent

SSH in and install XHack the same way you would on any Linux machine, then confirm it is on your path:

xhack --version

Everything the agent stores lives under ~/.xhack. Back that folder up and you have backed up your sessions, findings and tunnel state.

2. Turn Remote Access on

xhack tunnel

What this does, in order:

1. If this is the first time, it sets up a web console login and shows the username and password once. Copy them straight into your password manager.

2. It registers the server with XHack and prints a pairing code. Example:

   Waiting for approval on xhack.io · code A1B2
   

3. It opens the tunnel and prints your link once the device is approved.

Approve the server from your laptop or phone:

1. Sign in at xhack.io and go to Settings → Remote access.
2. Find the request from that server and click Approve.
3. Type the pairing code shown in the terminal and confirm.

A few seconds later the CLI prints:

Remote Access is on
Your link: https://yourname-a1b2c3.xhack.site

Open that link in any browser and sign in with the web console login from step 2.

More on the approval flow: Approve a device.

3. Keep it running (Linux)

xhack tunnel runs in the foreground, so closing the terminal stops it. For anything beyond a quick look, install the service so it starts on boot and restarts on its own:

xhack tunnel --install-service

That is all. The service runs even when nobody is logged in, and comes back on reboot.

Check it any time:

xhack tunnel status

Follow the logs:

xhack tunnel logs

Stop Remote Access for now (the service stays installed and comes back on the next reboot):

xhack tunnel stop

Remove the service for good and turn Remote Access off:

xhack tunnel --uninstall-service

On Windows and macOS use the desktop app's Turn on automatically when XHack starts option instead of --install-service. See Turn on Remote Access from the desktop app.

4. Day-to-day commands

Command	What it does
xhack tunnel	Turn Remote Access on. First use pairs the device and sets up a login.
xhack tunnel status	Show whether Remote Access is on, your link, and any waiting pairing code.
xhack tunnel stop	Turn Remote Access off. Your link goes offline.
xhack tunnel logs	Recent Remote Access activity, for troubleshooting.
xhack tunnel --rotate-login	Replace your web console login with a new strong one, shown once.
xhack tunnel --install-service	Linux only. Keep Remote Access running across reboots.
xhack tunnel --uninstall-service	Linux only. Remove the always-on service and turn Remote Access off.

A few habits that save time:

• Pressing Ctrl+C on xhack tunnel only stops the live status in your terminal. Remote Access keeps running in the background. Use xhack tunnel stop to turn it off.
• Running xhack tunnel again when it is already up just shows the current status. It never starts a second copy.
• xhack tunnel stop also stops the always-on service, but it does not uninstall it. The service comes back after the next reboot. Use --uninstall-service to remove it for good.

Rotating the login

Change the web console username and password on a schedule, and always after an engagement, after you have shared the link with anyone, or the moment you suspect it leaked:

xhack tunnel --rotate-login

The new credentials are shown once. Save them to your password manager.

When xhack tunnel asks about an existing login during a first-time start, press Enter to keep it, or type r to replace it with a new one.

When your plan changes

• Plan ends: your link goes offline. It is kept for 10 days. Renew within those 10 days and you get the same link back.
• After 10 days: the link is permanently deleted. A later subscription gives you a new link.

Your server keeps its web console login through this. You do not need to recreate it.

Related

• Remote Access overview
• Approve a device
• Manage your devices
• Security tips
• Troubleshooting
• Hosting the web console yourself on a VPS, the lower-level option when you need to run a public endpoint of your own.