-
-
Save ktosiu/71e2fde72899cad1c4fe6c83978bea20 to your computer and use it in GitHub Desktop.
quick and simple honeypot in python3 using scapy, and raw sockets file logging
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
import argparse | |
import threading | |
from threading import Thread | |
from scapy.all import * | |
import logging | |
import socket | |
import chardet | |
def listen(): | |
try: | |
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) | |
s.bind(('', port)) | |
s.listen(5) | |
while 1: | |
try: | |
conn, addr = s.accept() | |
received = conn.recv(1024) | |
encoding = chardet.detect(received)['encoding'] | |
if encoding is not None: | |
received = received.decode(encoding) | |
else: | |
received = received.decode('UTF-8') | |
conn.send(bytes(banner.encode(encoding))) | |
except TypeError: | |
pass | |
s.close() | |
except OSError: | |
print("cannot bind port :(") | |
exit(1) | |
def packet_callback(packet): | |
if packet[TCP].payload: | |
pkt = packet[TCP].payload | |
if packet[IP].dport == port: | |
logger.info('\n{} ----{}----> {}:\n{}'.format(packet[IP].src, port, packet[IP].dst, pkt)) | |
if verbosity: | |
print('\n{} ----{}----> {}:{}:\n{}'.format(packet[IP].src, port, packet[IP].dst, packet[IP].dport, pkt)) | |
def main(): | |
parser = argparse.ArgumentParser(description='honey.py - a simple script for honeypotting stuff with python3\n') | |
parser.add_argument('--banner', '-b', type=str, default=None, required=True, help='Banner to send to connecting clients') | |
parser.add_argument('--port', '-p', type=int, default=23, required=True, help='Port number to listen on (default is 23 for telnet)') | |
parser.add_argument('--log', '-l', type=str, default='/var/log/honey.log', required=False, help='Where to log captured data (/var/log/honey.log by default)') | |
parser.add_argument('--verbose', '-v', default=False, required=False, action='store_true', help='verbose') | |
args = parser.parse_args() | |
global banner | |
banner = args.banner | |
global port | |
port = args.port | |
global verbosity | |
verbosity = args.verbose | |
# Logging configuration | |
global logger | |
logger = logging.getLogger(__name__) | |
logging.getLogger("scapy.runtime").setLevel(logging.ERROR) | |
logger.setLevel(logging.INFO) | |
if args.log != '/var/log/honey.log': | |
handler = logging.FileHandler(args.log) | |
else: | |
handler = logging.FileHandler('/var/log/honey.log') | |
handler.setLevel(logging.INFO) | |
formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s\n') | |
handler.setFormatter(formatter) | |
logger.addHandler(handler) | |
# Start listening on specified port | |
Thread(name = 'listen', target = listen).start() | |
sniff(filter="tcp", prn=packet_callback, store=False) | |
if __name__ == '__main__': | |
main() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment