DOCSEARCHbyAlgolia
Submit Docs

honeytrap

repository·master·Indexed 23 days ago

https://github.com/honeytrap/honeytrap

An extensible, open-source system for running, monitoring, and managing honeypots. It features an agent-server architecture for centralized configuration and logging, protocol intelligence for multi-protocol port handling, and support for low- to high-interaction honeypots via LXC or remote hosts. The system includes built-in services for FTP, LDAP, and SMTP, and supports exporting logs to Elasticsearch, Kafka, Splunk, Raven, File, or Console.

Tokens
2.5K
Snippets
3
Records
18
Agent score
80%

What's inside honeytrap

  1. Overview of Honeytrap features

    master

    Honeytrap is an extensible, open-source system designed for running, monitoring, and managing honeypots. Key capabilities include:

    • Service Aggregation: Combine multiple services into a single honeypot (e.g., a LAMP server).
    • Agent-Server Architecture: Honeytrap Agents automatically download configurations from a central Honeytrap Server, allowing for large-scale deployments with centralized logging.
    • Traffic Redirection: Use agents to redirect traffic out of a network to a separate, isolated network.
    • Protocol Intelligence: Payload detection allows a single port to handle multiple protocols by determining which service should process a specific request.
    • Lateral Movement Monitoring: The Sensor listener can monitor internal network movement by completing TCP handshakes and storing payloads.
    • Interaction Levels: Supports low- to high-interaction honeypots, including seamless upgrades from low to high interaction. High interaction is achieved via LXC or remote hosts directors where traffic is man-in-the-middle proxied.
    • Extensibility: Integrate existing honeypots (like cowrie or glutton) into the Honeytrap logging and listening framework.
    • Advanced Logging: Supports filtering and exporting logs to Elasticsearch, Kafka, Splunk, Raven, File, or Console.

  3. Run the Honeytrap server

    master

    To start the Honeytrap honeypot server, run the honeytrap executable. The server will attempt to find a configuration file in the following order of priority:

    1. The file specified by the --config flag.
    2. /etc/honeytrap/config.toml
    3. /etc/honeytrap.toml

    Basic Usage

    honeytrap --config my_config.toml --data ./my_data_dir

    Remote Configuration

    The --config flag supports remote URLs for configuration via http or https schemes:

    honeytrap --config https://example.com/config.toml

  4. Configure an FTP server with ServerOpts

    master

    The ServerOpts struct defines the configuration for an FTP server. Use this struct to specify authentication, network settings, and TLS requirements.

    Key configuration fields:

    • Auth: An Auth implementation for handling user authentication.
    • Name: The server name (defaults to Go FTP Server).
    • Hostname: The interface to listen on (defaults to ::, meaning all IPv4 and IPv6 interfaces).
    • PublicIP: The public IP address of the server, used for passive mode reporting.
    • PassivePorts: A port range for passive mode (e.g., "10-20").
    • TLS: Enables TLS support (defaults to false).
    • ExplicitFTPS: If true, TLS is used in RFC4217 mode.
    • WelcomeMessage: The message sent to clients upon connection.

  5. List available Honeytrap components

    master

    You can use the Honeytrap CLI to discover which services, channels, and listeners are built into the system by using the --list-* flags.

    List Services

    To see all available honeypot services:

    honeytrap --list-services

    List Channels

    To see all available data push channels (pushers):

    honeytrap --list-channels

    List Listeners

    To see all available network listeners:

    honeytrap --list-listeners

  6. Implement an SMTP message handler

    master
    To process incoming SMTP messages, you can implement the Handler interface or use the HandlerFunc type. The Handler interface requires a Serve(msg Message) error method. Alternatively, you can use HandleFunc to register simple functions that match the func(msg Message) error signature.

  7. Configure the SMTP Server

    master

    The Server struct is the primary orchestrator for the SMTP service.

    Fields:

    • Banner string: The greeting message sent to clients upon connection.
    • Handler Handler: The handler used to process messages. If this is nil, the server defaults to using DefaultServeMux.
    • tlsConfig *tls.Config: Configuration for TLS connections.

  9. Use ServeMux to route SMTP messages

    master

    The ServeMux acts as a multiplexer that allows you to register multiple handlers. When Serve(msg Message) is called on the mux, it executes all registered handlers in the order they were added. If any handler returns an error, the execution stops and the error is returned.

    Key methods:

    • NewServeMux(): Creates a new instance of ServeMux.
    • HandleFunc(handler func(msg Message) error): Registers a new handler function.
    • Serve(msg Message) error: Executes all registered handlers sequentially.

  11. Initialize an FTP server with NewServer()

    master

    To start an FTP service, use the NewServer function. It accepts a pointer to a ServerOpts struct and returns a *Server instance. The function automatically applies default values for any fields left empty in the ServerOpts provided.

    Server is the root of your FTP application; once instantiated, you should call its ListenAndServe() method (available on the Server type) to begin accepting client connections.

  12. Honeytrap CLI Global Flags

    master

    The Honeytrap CLI provides several global flags to control configuration, data storage, profiling, and discovery of available components. These flags can be used with the main command.

    Configuration and Storage

    • --config, -c: Specifies the path to the configuration file. Defaults to config.toml. Supports file:// and http(s):// schemes.
    • --data, -d: Specifies the directory where data will be stored. Defaults to ~/.honeytrap.

    Profiling

    • --cpu-profile: Enables the CPU profiler.
    • --mem-profile: Enables the memory profiler.

    Discovery

    • --list-services: Lists all available honeypot services.
    • --list-channels: Lists all available data push channels.
    • --list-listeners: Lists all available network listeners.