honeypots
1.0.0
30 HoneyPots de nível baixo em um único pacote PYPI para monitorar o tráfego de rede, atividades de bots e credenciais de nome de usuário senha.
Os HoneyPots respondem de volta, sem bloqueio, podem ser usados como objetos ou chamados diretamente com os scripts de configuração automática embutida! Além disso, eles são fáceis de configurar e personalizar; Demora 1-2 segundos para girar um honeypot para cima. Você pode aumentar várias instâncias com o mesmo tipo. Para facilitar a integração, a saída pode ser registrada em um banco de dados do Postgres, arquivos [s), terminal ou syslog.
This honeypots package is the only package that contains all the following: dhcp, dns, elastic, ftp, http proxy, https proxy, http, https, imap, ipp, irc, ldap, memcache, mssql, mysql, ntp, oracle, pjl, pop3, postgres, rdp, redis, sip, smb, SMTP, SNMP, SOCKS5, SSH, TELNET, VNC.
O HoneyPots está no incrível projeto T-POT da Telekom Security!
capture_commands às opções para capturar mais informações sobre a fonte de ameaça (veja a mesa se for suportada ou não) pip3 install honeypots
Qeeqbox/honeypots customizable honeypots for monitoring network traffic, bots activities, and username p assword credentials
Arguments:
--setup target honeypot E.g. ssh or you can have multiple E.g ssh,http,https
--list list all available honeypots
--kill kill all honeypots
--verbose Print error msgs
Honeypots options:
--ip Override the IP
--port Override the Port (Do not use on multiple ! )
--username Override the username
--password Override the password
--config Use a config file for honeypots settings
--options Extra options (capture_commands for capturing all threat actor data)
General options:
--termination-strategy {input,signal} Determines the strategy to terminate by
--test Test a honeypot
--auto Setup the honeypot with random port Honeypot, ou múltiplos honeypots separados por vírgula ou palavra all
sudo -E python3 -m honeypots --setup ssh --options capture_commands
Honeypot, ou múltiplos honeypots separados por vírgula ou palavra all
python3 -m honeypots --setup ssh --auto
Use como Honeypot: Porta ou Múltiplos Honeypots como Honeypot: Porta, Honeypot: Porta
sudo -E python3 -m honeypots --setup imap:143,mysql:3306,redis:6379
Honeypot, ou múltiplos honeypots em um ditado
sudo -E python3 -m honeypots --setup ftp --config config.json{
"logs" : " file,terminal,json " ,
"logs_location" : " /var/log/honeypots/ " ,
"syslog_address" : " " ,
"syslog_facility" : 0 ,
"postgres" : " " ,
"sqlite_file" : " " ,
"db_options" : [],
"sniffer_filter" : " " ,
"sniffer_interface" : " " ,
"honeypots" : {
"ftp" : {
"port" : 21 ,
"ip" : " 0.0.0.0 " ,
"username" : " ftp " ,
"password" : " anonymous " ,
"log_file_name" : " ftp.log " ,
"max_bytes" : 10000 ,
"backup_count" : 10 ,
"options" :[ " capture_commands " ]
}
}
}{
"logs" : " syslog " ,
"logs_location" : " " ,
"syslog_address" : " udp://localhost:514 " ,
"syslog_facility" : 3 ,
"postgres" : " " ,
"sqlite_file" : " " ,
"db_options" : [],
"sniffer_filter" : " " ,
"sniffer_interface" : " " ,
"honeypots" : {
"ftp" : {
"port" : 21 ,
"ip" : " 0.0.0.0 " ,
"username" : " test " ,
"password" : " test " ,
"options" :[ " capture_commands " ]
}
}
}
{
"logs" : " db_postgres " ,
"logs_location" : " " ,
"syslog_address" : " " ,
"syslog_facility" : 0 ,
"postgres" : " //username:[email protected]:9999/honeypots " ,
"sqlite_file" : " " ,
"db_options" :[ " drop " ],
"sniffer_filter" : " " ,
"sniffer_interface" : " " ,
"honeypots" : {
"ftp" : {
"port" : 21 ,
"username" : " test " ,
"password" : " test "
}
}
}{
"logs" : " db_postgres " ,
"logs_location" : " " ,
"syslog_address" : " " ,
"syslog_facility" : 0 ,
"postgres" : " " ,
"sqlite_file" : " /home/test.db " ,
"db_options" :[ " drop " ],
"sniffer_sniffer_filter" : " " ,
"sniffer_interface" : " " ,
"honeypots" : {
"ftp" : {
"port" : 21 ,
"username" : " test " ,
"password" : " test " ,
"options" :[ " capture_commands " ]
}
}
}[
{
"id" : 1 ,
"date" : " 2021-11-18 06:06:42.304338+00 " ,
"data" : {
"server" : " ftp_server " ,
"action" : " process " ,
"status" : " success " ,
"ip" : " 0.0.0.0 " ,
"port" : " 21 " ,
"username" : " test " ,
"password" : " test "
}
}
] from honeypots import QSSHServer
qsshserver = QSSHServer ( port = 9999 )
qsshserver . run_server ( process = True )
qsshserver . test_server ( port = 9999 )
INFO : chameleonlogger :[ 'servers' , { 'status' : 'success' , 'username' : 'test' , 'src_ip' : '127.0.0.1' , 'server' : 'ssh_server' , 'action' : 'login' , 'password' : 'test' , 'src_port' : 38696 }]
qsshserver . kill_server () #you need higher user permissions for bindingclosing some ports
from honeypots import QSSHServer
qsshserver = QSSHServer ( port = 9999 )
qsshserver . run_server ( process = True ) INFO : chameleonlogger :[ 'servers' , { 'status' : 'success' , 'username' : 'test' , 'src_ip' : '127.0.0.1' , 'server' : 'ssh_server' , 'action' : 'login' , 'password' : 'test' , 'src_port' : 38696 }]
qsshserver . kill_server () ' error ' : ' Information about current error '
' server ' : ' Server name '
' timestamp ' : ' Time in ISO '
' action ' : ' Query, login, etc.. '
' data ' : ' More info about the action '
' status ' : ' The return status of the action (success or fail) '
' dest_ip ' : ' Server address '
' dest_port ' : ' Server port '
' src_ip ' : ' Attacker address '
' src_port ' : ' Attacker port '
' username ' : ' Attacker username '
' password ' : ' Attacker password ' "template" para este servidor em config.json (deve ser um caminho absoluto)pipenv twisted psutil dnspython requests impacket paramiko redis mysql-connector pycryptodome vncdotool service_identity requests[socks] pygments http.server
