From 6e638c85ab1c06bb46a880d72d738800722b9772 Mon Sep 17 00:00:00 2001 From: Mario Date: Sat, 14 May 2022 19:04:44 +0200 Subject: [PATCH] Improve README.md --- README.md | 124 +++++++++++++++++++++++++ configurations/services/http-8080.yaml | 6 +- 2 files changed, 126 insertions(+), 4 deletions(-) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..dd7a96d --- /dev/null +++ b/README.md @@ -0,0 +1,124 @@ +# Beelzebub ![CI](https://github.com/mariocandela/beelzebub/actions/workflows/ci.yml/badge.svg) + +A secure multi protocol low interaction honeypot, extremely easy to configure by yaml 🚀 + +## Quick Start + +Using [`docker-compose`](https://docs.docker.com/compose/) + +```bash +$ docker-compose build +$ docker-compose up -d + ``` + +Using [`go compiler`](https://go.dev/doc/install) + +```bash +$ go mod download +$ go build +$ ./beelzebub + ``` + +## Example configuration service + +The configurations are inside the /configurations/services directory, just add a new file for each service/port. + +### Example HTTP Honeypot on 80 port + +######http-80.yaml + +```yaml +apiVersion: "v1" +protocol: "http" +address: ":80" +commands: + - regex: "microtick" + handler: "\r\n\r\n\r\n\r\n\r\nRouterOS router configuration page\r\n\r\n\r\n\r\n\r\n\r\n\r\n
\r\n\r\n
\r\n \r\n\r\n
\r\n \r\n\t\t

RouterOS v6.42.12

\r\n \r\n

You have connected to a router. Administrative access only. If this device is not in your possession, please contact your local network administrator.

\r\n \r\n \r\n\t

WebFig Login:

\r\n
Login: \r\n\t \r\n \r\n
Password: \r\n\t
\r\n\t
\r\n
\r\n \r\n
\r\n
\r\n \t
\r\n \r\n
\r\n \r\n
\r\n \t
\r\n \r\n
\r\n\r\n \r\n \r\n
\r\n \t
\r\n \r\n
\r\n \r\n \r\n
\r\n \t
\r\n \r\n
\r\n \r\n\t\t\t
\r\n \t
\r\n \r\n
\r\n\r\n
\r\n \r\n
\r\n
© mikrotik
\r\n\r\n
\r\n
\r\n\r\n\r\n\r\n\r\n\r\n" + headers: + - "Content-Type: text/html" + - "Expires: 0" + - "Version: 6.42.12" + statusCode: 200 + - regex: "hello" + handler: "world!" + headers: + - "Content-Type: text/html" + statusCode: 500 + ``` + +### Example HTTP Honeypot on 8080 port + +######http-8080.yaml + +```yaml +apiVersion: "v1" +protocol: "http" +address: ":8080" +commands: + - regex: "wp-admin" + handler: "Unauthorized" + headers: + - "Content-Type: text/html" + statusCode: 401 + ``` + +### Example SSH Honeypot + +######ssh-22.yaml + +```yaml +apiVersion: "v1" +protocol: "ssh" +address: ":22" +commands: + - regex: "^ls$" + handler: "Documents Images Desktop Downloads .m2 .kube .ssh .docker" + - regex: "^pwd$" + handler: "/home/" + - regex: "^uname -m$" + handler: "x86_64" + - regex: "^docker ps$" + handler: "CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES" + - regex: "^docker .*$" + handler: "Error response from daemon: dial unix docker.raw.sock: connect: connection refused" + - regex: "^uname$" + handler: "Linux" + - regex: "^ps$" + handler: " PID TTY TIME CMD\n21642 ttys000 0:00.07 /bin/dockerd" + - regex: "^(.+)$" + handler: "command not found" +serverVersion: "OpenSSH" +serverName: "ubuntu" +passwordRegex: "^(root|qwerty)$" +deadlineTimeoutSeconds: 60 + ``` + +## Features + +- SSH Honeypot +- HTTP Honeypot +- Easy to create a new strategy +- Easy to extend event tracking logic +- Strong code quality +- Docker + +## TODO + +- telnet +- tcp + +## Documentation + +- [API Docs](https://) #TODO + +## Contributing + +The beelzebub team enthusiastically welcomes contributions and project participation! There's a bunch of things you can do if you want to contribute! The [Contributor Guide](CONTRIBUTING.md) has all the information you need for everything from reporting bugs to contributing entire new features. Please don't hesitate to jump in if you'd like to, or even ask us questions if something isn't clear. + +All participants and maintainers in this project are expected to follow [Code of Conduct](CODE_OF_CONDUCT.md), and just generally be excellent to each other. + +Happy hacking! + +## License + +This project is licensed under [GNU GPL 3 License](LICENSE). \ No newline at end of file diff --git a/configurations/services/http-8080.yaml b/configurations/services/http-8080.yaml index d738300..53178a7 100644 --- a/configurations/services/http-8080.yaml +++ b/configurations/services/http-8080.yaml @@ -3,9 +3,7 @@ protocol: "http" address: ":8080" commands: - regex: "wp-admin" - handler: "login" + handler: "Unauthorized" headers: - "Content-Type: text/html" - - "Expires: 0" - - "Version: 6.42.12" - statusCode: 200 \ No newline at end of file + statusCode: 401 \ No newline at end of file