diff --git a/README.md b/README.md index 2da5282..af5c963 100644 --- a/README.md +++ b/README.md @@ -31,21 +31,27 @@ The configurations are inside the /configurations/services directory, just add a apiVersion: "v1" protocol: "http" address: ":80" +description: "Wordpress 6.0" commands: - - regex: "microtick" - handler: "\r\n\r\n\r\n\r\n\r\nRouterOS router configuration page\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n\r\n
\r\n \r\n\r\n
\r\n \r\n\t\t

RouterOS v6.42.12

\r\n \r\n

You have connected to a router. Administrative access only. If this device is not in your possession, please contact your local network administrator.

\r\n \r\n \r\n\t

WebFig Login:

\r\n
Login: \r\n\t \r\n \r\n
Password: \r\n\t
\r\n\t
\r\n
\r\n \r\n
\r\n
\r\n \t
\r\n \r\n
\r\n \r\n
\r\n \t
\r\n \r\n
\r\n\r\n \r\n \r\n
\r\n \t
\r\n \r\n
\r\n \r\n \r\n
\r\n \t
\r\n \r\n
\r\n \r\n\t\t\t
\r\n \t
\r\n \r\n
\r\n\r\n
\r\n \r\n
\r\n
© mikrotik
\r\n\r\n
\r\n
\r\n\r\n\r\n\r\n\r\n\r\n" + - regex: "index.php" + handler: "test – Just another WordPress site
" headers: - "Content-Type: text/html" - - "Expires: 0" - - "Version: 6.42.12" + - "Server: Apache/2.4.53 (Debian)" + - "X-Powered-By: PHP/7.4.29" statusCode: 200 - - regex: "hello" - handler: "world!" + - regex: "^(wp-login.php|/wp-admin)$" + handler: "Log In ‹ test — WordPress

Powered by WordPress

Lost your password?

← Go to test

" headers: - "Content-Type: text/html" - statusCode: 500 + - "Server: Apache/2.4.53 (Debian)" + - "X-Powered-By: PHP/7.4.29" + statusCode: 200 ``` +![alt text](https://i.postimg.cc/529V6jYz/Schermata-2022-06-02-alle-12-42-46.png) + + ### Example HTTP Honeypot on 8080 port ###### http-8080.yaml @@ -54,14 +60,18 @@ commands: apiVersion: "v1" protocol: "http" address: ":8080" +description: "Apache 401" commands: - - regex: "wp-admin" + - regex: ".*" handler: "Unauthorized" headers: - - "Content-Type: text/html" + - "www-Authenticate: Basic" + - "server: Apache" statusCode: 401 ``` +![alt text](https://i.postimg.cc/T1cs6qc4/Schermata-2022-06-02-alle-12-43-55.png) + ### Example SSH Honeypot ###### ssh-22.yaml @@ -70,6 +80,7 @@ commands: apiVersion: "v1" protocol: "ssh" address: ":22" +description: "SSH interactive" commands: - regex: "^ls$" handler: "Documents Images Desktop Downloads .m2 .kube .ssh .docker" @@ -89,10 +100,12 @@ commands: handler: "command not found" serverVersion: "OpenSSH" serverName: "ubuntu" -passwordRegex: "^(root|qwerty)$" +passwordRegex: "^(root|qwerty|Smoker666)$" deadlineTimeoutSeconds: 60 ``` +![alt text](https://i.postimg.cc/jdpfT0LB/Schermata-2022-06-02-alle-12-46-50.png) + ## Features - SSH Honeypot @@ -101,6 +114,7 @@ deadlineTimeoutSeconds: 60 - Easy to extend event tracking logic - Strong code quality - Docker +- RabbitMQ integration ## TODO