Skip to content

Instantly share code, notes, and snippets.

@dustyfresh
Last active September 15, 2020 16:42
Show Gist options
  • Save dustyfresh/9b8a7ab39e9c483f983adb3d279c4d92 to your computer and use it in GitHub Desktop.
Save dustyfresh/9b8a7ab39e9c483f983adb3d279c4d92 to your computer and use it in GitHub Desktop.
quick and simple honeypot in python3 using scapy, and raw sockets file logging
#!/usr/bin/env python3
import argparse
import threading
from threading import Thread
from scapy.all import *
import logging
import socket
import chardet
def listen():
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('', port))
s.listen(5)
while 1:
try:
conn, addr = s.accept()
received = conn.recv(1024)
encoding = chardet.detect(received)['encoding']
if encoding is not None:
received = received.decode(encoding)
else:
received = received.decode('UTF-8')
conn.send(bytes(banner.encode(encoding)))
except TypeError:
pass
s.close()
except OSError:
print("cannot bind port :(")
exit(1)
def packet_callback(packet):
if packet[TCP].payload:
pkt = packet[TCP].payload
if packet[IP].dport == port:
logger.info('\n{} ----{}----> {}:\n{}'.format(packet[IP].src, port, packet[IP].dst, pkt))
if verbosity:
print('\n{} ----{}----> {}:{}:\n{}'.format(packet[IP].src, port, packet[IP].dst, packet[IP].dport, pkt))
def main():
parser = argparse.ArgumentParser(description='honey.py - a simple script for honeypotting stuff with python3\n')
parser.add_argument('--banner', '-b', type=str, default=None, required=True, help='Banner to send to connecting clients')
parser.add_argument('--port', '-p', type=int, default=23, required=True, help='Port number to listen on (default is 23 for telnet)')
parser.add_argument('--log', '-l', type=str, default='/var/log/honey.log', required=False, help='Where to log captured data (/var/log/honey.log by default)')
parser.add_argument('--verbose', '-v', default=False, required=False, action='store_true', help='verbose')
args = parser.parse_args()
global banner
banner = args.banner
global port
port = args.port
global verbosity
verbosity = args.verbose
# Logging configuration
global logger
logger = logging.getLogger(__name__)
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
logger.setLevel(logging.INFO)
if args.log != '/var/log/honey.log':
handler = logging.FileHandler(args.log)
else:
handler = logging.FileHandler('/var/log/honey.log')
handler.setLevel(logging.INFO)
formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s\n')
handler.setFormatter(formatter)
logger.addHandler(handler)
# Start listening on specified port
Thread(name = 'listen', target = listen).start()
sniff(filter="tcp", prn=packet_callback, store=False)
if __name__ == '__main__':
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment