mirror of
https://github.com/mariocandela/beelzebub.git
synced 2025-07-01 18:47:26 -04:00
feat: add source ip and source port (#126)
add source ip and source port
This commit is contained in:
@ -6,6 +6,7 @@ import (
|
|||||||
"github.com/mariocandela/beelzebub/v3/plugins"
|
"github.com/mariocandela/beelzebub/v3/plugins"
|
||||||
"github.com/mariocandela/beelzebub/v3/tracer"
|
"github.com/mariocandela/beelzebub/v3/tracer"
|
||||||
"io"
|
"io"
|
||||||
|
"net"
|
||||||
"net/http"
|
"net/http"
|
||||||
"regexp"
|
"regexp"
|
||||||
"strings"
|
"strings"
|
||||||
@ -91,6 +92,8 @@ func traceRequest(request *http.Request, tr tracer.Tracer, HoneypotDescription s
|
|||||||
if err == nil {
|
if err == nil {
|
||||||
body = string(bodyBytes)
|
body = string(bodyBytes)
|
||||||
}
|
}
|
||||||
|
host, port, _ := net.SplitHostPort(request.RemoteAddr)
|
||||||
|
|
||||||
tr.TraceEvent(tracer.Event{
|
tr.TraceEvent(tracer.Event{
|
||||||
Msg: "HTTP New request",
|
Msg: "HTTP New request",
|
||||||
RequestURI: request.RequestURI,
|
RequestURI: request.RequestURI,
|
||||||
@ -103,6 +106,8 @@ func traceRequest(request *http.Request, tr tracer.Tracer, HoneypotDescription s
|
|||||||
Headers: mapHeaderToString(request.Header),
|
Headers: mapHeaderToString(request.Header),
|
||||||
Status: tracer.Stateless.String(),
|
Status: tracer.Stateless.String(),
|
||||||
RemoteAddr: request.RemoteAddr,
|
RemoteAddr: request.RemoteAddr,
|
||||||
|
SourceIp: host,
|
||||||
|
SourcePort: port,
|
||||||
ID: uuid.New().String(),
|
ID: uuid.New().String(),
|
||||||
Description: HoneypotDescription,
|
Description: HoneypotDescription,
|
||||||
})
|
})
|
||||||
|
@ -5,8 +5,8 @@ import (
|
|||||||
"github.com/mariocandela/beelzebub/v3/parser"
|
"github.com/mariocandela/beelzebub/v3/parser"
|
||||||
"github.com/mariocandela/beelzebub/v3/plugins"
|
"github.com/mariocandela/beelzebub/v3/plugins"
|
||||||
"github.com/mariocandela/beelzebub/v3/tracer"
|
"github.com/mariocandela/beelzebub/v3/tracer"
|
||||||
|
"net"
|
||||||
"regexp"
|
"regexp"
|
||||||
|
|
||||||
"strings"
|
"strings"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
@ -29,10 +29,14 @@ func (sshStrategy *SSHStrategy) Init(beelzebubServiceConfiguration parser.Beelze
|
|||||||
Handler: func(sess ssh.Session) {
|
Handler: func(sess ssh.Session) {
|
||||||
uuidSession := uuid.New()
|
uuidSession := uuid.New()
|
||||||
|
|
||||||
|
host, port, _ := net.SplitHostPort(sess.RemoteAddr().String())
|
||||||
|
|
||||||
tr.TraceEvent(tracer.Event{
|
tr.TraceEvent(tracer.Event{
|
||||||
Msg: "New SSH Session",
|
Msg: "New SSH Session",
|
||||||
Protocol: tracer.SSH.String(),
|
Protocol: tracer.SSH.String(),
|
||||||
RemoteAddr: sess.RemoteAddr().String(),
|
RemoteAddr: sess.RemoteAddr().String(),
|
||||||
|
SourceIp: host,
|
||||||
|
SourcePort: port,
|
||||||
Status: tracer.Start.String(),
|
Status: tracer.Start.String(),
|
||||||
ID: uuidSession.String(),
|
ID: uuidSession.String(),
|
||||||
Environ: strings.Join(sess.Environ(), ","),
|
Environ: strings.Join(sess.Environ(), ","),
|
||||||
@ -95,6 +99,8 @@ func (sshStrategy *SSHStrategy) Init(beelzebubServiceConfiguration parser.Beelze
|
|||||||
tr.TraceEvent(tracer.Event{
|
tr.TraceEvent(tracer.Event{
|
||||||
Msg: "New SSH Terminal Session",
|
Msg: "New SSH Terminal Session",
|
||||||
RemoteAddr: sess.RemoteAddr().String(),
|
RemoteAddr: sess.RemoteAddr().String(),
|
||||||
|
SourceIp: host,
|
||||||
|
SourcePort: port,
|
||||||
Status: tracer.Interaction.String(),
|
Status: tracer.Interaction.String(),
|
||||||
Command: commandInput,
|
Command: commandInput,
|
||||||
CommandOutput: commandOutput,
|
CommandOutput: commandOutput,
|
||||||
@ -113,6 +119,8 @@ func (sshStrategy *SSHStrategy) Init(beelzebubServiceConfiguration parser.Beelze
|
|||||||
})
|
})
|
||||||
},
|
},
|
||||||
PasswordHandler: func(ctx ssh.Context, password string) bool {
|
PasswordHandler: func(ctx ssh.Context, password string) bool {
|
||||||
|
host, port, _ := net.SplitHostPort(ctx.RemoteAddr().String())
|
||||||
|
|
||||||
tr.TraceEvent(tracer.Event{
|
tr.TraceEvent(tracer.Event{
|
||||||
Msg: "New SSH attempt",
|
Msg: "New SSH attempt",
|
||||||
Protocol: tracer.SSH.String(),
|
Protocol: tracer.SSH.String(),
|
||||||
@ -121,6 +129,8 @@ func (sshStrategy *SSHStrategy) Init(beelzebubServiceConfiguration parser.Beelze
|
|||||||
Password: password,
|
Password: password,
|
||||||
Client: ctx.ClientVersion(),
|
Client: ctx.ClientVersion(),
|
||||||
RemoteAddr: ctx.RemoteAddr().String(),
|
RemoteAddr: ctx.RemoteAddr().String(),
|
||||||
|
SourceIp: host,
|
||||||
|
SourcePort: port,
|
||||||
ID: uuid.New().String(),
|
ID: uuid.New().String(),
|
||||||
Description: beelzebubServiceConfiguration.Description,
|
Description: beelzebubServiceConfiguration.Description,
|
||||||
})
|
})
|
||||||
|
@ -35,12 +35,16 @@ func (tcpStrategy *TCPStrategy) Init(beelzebubServiceConfiguration parser.Beelze
|
|||||||
command = string(buffer[:n])
|
command = string(buffer[:n])
|
||||||
}
|
}
|
||||||
|
|
||||||
|
host, port, _ := net.SplitHostPort(conn.RemoteAddr().String())
|
||||||
|
|
||||||
tr.TraceEvent(tracer.Event{
|
tr.TraceEvent(tracer.Event{
|
||||||
Msg: "New TCP attempt",
|
Msg: "New TCP attempt",
|
||||||
Protocol: tracer.TCP.String(),
|
Protocol: tracer.TCP.String(),
|
||||||
Command: command,
|
Command: command,
|
||||||
Status: tracer.Stateless.String(),
|
Status: tracer.Stateless.String(),
|
||||||
RemoteAddr: conn.RemoteAddr().String(),
|
RemoteAddr: conn.RemoteAddr().String(),
|
||||||
|
SourceIp: host,
|
||||||
|
SourcePort: port,
|
||||||
ID: uuid.New().String(),
|
ID: uuid.New().String(),
|
||||||
Description: beelzebubServiceConfiguration.Description,
|
Description: beelzebubServiceConfiguration.Description,
|
||||||
})
|
})
|
||||||
|
@ -34,6 +34,8 @@ type Event struct {
|
|||||||
HTTPMethod string
|
HTTPMethod string
|
||||||
RequestURI string
|
RequestURI string
|
||||||
Description string
|
Description string
|
||||||
|
SourceIp string
|
||||||
|
SourcePort string
|
||||||
}
|
}
|
||||||
|
|
||||||
type (
|
type (
|
||||||
|
Reference in New Issue
Block a user