honeypots
1.0.0
30 Honeypots de bajo nivel de alto nivel en un solo paquete PYPI para monitorear el tráfico de red, las actividades de Bots y las credenciales de contraseña de nombre de usuario.
¡Los Honeypots responden, no bloquean, se pueden usar como objetos, o llamados directamente con los scripts de autoconfiguración de construcción incorporados! Además, son fáciles de configurar y personalizar; Se tarda 1-2 segundos en girar un honeypot. Puede girar múltiples instancias con el mismo tipo. Para una fácil integración, la salida se puede registrar a una base de datos Postgres, archivo [s], terminal o syslog.
This honeypots package is the only package that contains all the following: dhcp, dns, elastic, ftp, http proxy, https proxy, http, https, imap, ipp, irc, ldap, memcache, mssql, mysql, ntp, oracle, pjl, pop3, postgres, rdp, redis, sip, smb, SMTP, SNMP, SOCKS5, SSH, TELNET, VNC.
¡Honeypots está en el increíble proyecto T-Pot Telekom Security!
capture_commands a opciones para capturar más información sobre la fuente de amenazas (mire la tabla si es compatible o no) pip3 install honeypots
Qeeqbox/honeypots customizable honeypots for monitoring network traffic, bots activities, and username p assword credentials
Arguments:
--setup target honeypot E.g. ssh or you can have multiple E.g ssh,http,https
--list list all available honeypots
--kill kill all honeypots
--verbose Print error msgs
Honeypots options:
--ip Override the IP
--port Override the Port (Do not use on multiple ! )
--username Override the username
--password Override the password
--config Use a config file for honeypots settings
--options Extra options (capture_commands for capturing all threat actor data)
General options:
--termination-strategy {input,signal} Determines the strategy to terminate by
--test Test a honeypot
--auto Setup the honeypot with random port honeypot, o múltiples honeypots separados por coma o all
sudo -E python3 -m honeypots --setup ssh --options capture_commands
honeypot, o múltiples honeypots separados por coma o all
python3 -m honeypots --setup ssh --auto
Use como honeypot: puerto o múltiples honeypots como honeypot: puerto, honeypot: puerto
sudo -E python3 -m honeypots --setup imap:143,mysql:3306,redis:6379
honeypot o múltiples honeypots en un dict
sudo -E python3 -m honeypots --setup ftp --config config.json{
"logs" : " file,terminal,json " ,
"logs_location" : " /var/log/honeypots/ " ,
"syslog_address" : " " ,
"syslog_facility" : 0 ,
"postgres" : " " ,
"sqlite_file" : " " ,
"db_options" : [],
"sniffer_filter" : " " ,
"sniffer_interface" : " " ,
"honeypots" : {
"ftp" : {
"port" : 21 ,
"ip" : " 0.0.0.0 " ,
"username" : " ftp " ,
"password" : " anonymous " ,
"log_file_name" : " ftp.log " ,
"max_bytes" : 10000 ,
"backup_count" : 10 ,
"options" :[ " capture_commands " ]
}
}
}{
"logs" : " syslog " ,
"logs_location" : " " ,
"syslog_address" : " udp://localhost:514 " ,
"syslog_facility" : 3 ,
"postgres" : " " ,
"sqlite_file" : " " ,
"db_options" : [],
"sniffer_filter" : " " ,
"sniffer_interface" : " " ,
"honeypots" : {
"ftp" : {
"port" : 21 ,
"ip" : " 0.0.0.0 " ,
"username" : " test " ,
"password" : " test " ,
"options" :[ " capture_commands " ]
}
}
}
{
"logs" : " db_postgres " ,
"logs_location" : " " ,
"syslog_address" : " " ,
"syslog_facility" : 0 ,
"postgres" : " //username:[email protected]:9999/honeypots " ,
"sqlite_file" : " " ,
"db_options" :[ " drop " ],
"sniffer_filter" : " " ,
"sniffer_interface" : " " ,
"honeypots" : {
"ftp" : {
"port" : 21 ,
"username" : " test " ,
"password" : " test "
}
}
}{
"logs" : " db_postgres " ,
"logs_location" : " " ,
"syslog_address" : " " ,
"syslog_facility" : 0 ,
"postgres" : " " ,
"sqlite_file" : " /home/test.db " ,
"db_options" :[ " drop " ],
"sniffer_sniffer_filter" : " " ,
"sniffer_interface" : " " ,
"honeypots" : {
"ftp" : {
"port" : 21 ,
"username" : " test " ,
"password" : " test " ,
"options" :[ " capture_commands " ]
}
}
}[
{
"id" : 1 ,
"date" : " 2021-11-18 06:06:42.304338+00 " ,
"data" : {
"server" : " ftp_server " ,
"action" : " process " ,
"status" : " success " ,
"ip" : " 0.0.0.0 " ,
"port" : " 21 " ,
"username" : " test " ,
"password" : " test "
}
}
] from honeypots import QSSHServer
qsshserver = QSSHServer ( port = 9999 )
qsshserver . run_server ( process = True )
qsshserver . test_server ( port = 9999 )
INFO : chameleonlogger :[ 'servers' , { 'status' : 'success' , 'username' : 'test' , 'src_ip' : '127.0.0.1' , 'server' : 'ssh_server' , 'action' : 'login' , 'password' : 'test' , 'src_port' : 38696 }]
qsshserver . kill_server () #you need higher user permissions for bindingclosing some ports
from honeypots import QSSHServer
qsshserver = QSSHServer ( port = 9999 )
qsshserver . run_server ( process = True ) INFO : chameleonlogger :[ 'servers' , { 'status' : 'success' , 'username' : 'test' , 'src_ip' : '127.0.0.1' , 'server' : 'ssh_server' , 'action' : 'login' , 'password' : 'test' , 'src_port' : 38696 }]
qsshserver . kill_server () ' error ' : ' Information about current error '
' server ' : ' Server name '
' timestamp ' : ' Time in ISO '
' action ' : ' Query, login, etc.. '
' data ' : ' More info about the action '
' status ' : ' The return status of the action (success or fail) '
' dest_ip ' : ' Server address '
' dest_port ' : ' Server port '
' src_ip ' : ' Attacker address '
' src_port ' : ' Attacker port '
' username ' : ' Attacker username '
' password ' : ' Attacker password ' "template" para este servidor en config.json (debería ser una ruta absoluta)pipenv twisted psutil dnspython requests impacket paramiko redis mysql-connector pycryptodome vncdotool service_identity requests[socks] pygments http.server
