mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-01 12:32:12 +00:00
replace es-head with elasticvue, tweaking
es-head does not support building with ARM64 and had to be replaced with the even better elasticvue elasticvue will now run within the nginx container, freeing some RAM :) on the way
This commit is contained in:
parent
6a277fd1e9
commit
12a413b4cb
22 changed files with 241 additions and 280 deletions
22
README.md
22
README.md
|
@ -37,7 +37,7 @@ Furthermore T-Pot includes the following tools
|
||||||
* [Cockpit](https://cockpit-project.org/running) for a lightweight, webui for docker, os, real-time performance monitoring and web terminal.
|
* [Cockpit](https://cockpit-project.org/running) for a lightweight, webui for docker, os, real-time performance monitoring and web terminal.
|
||||||
* [Cyberchef](https://gchq.github.io/CyberChef/) a web app for encryption, encoding, compression and data analysis.
|
* [Cyberchef](https://gchq.github.io/CyberChef/) a web app for encryption, encoding, compression and data analysis.
|
||||||
* [ELK stack](https://www.elastic.co/videos) to beautifully visualize all the events captured by T-Pot.
|
* [ELK stack](https://www.elastic.co/videos) to beautifully visualize all the events captured by T-Pot.
|
||||||
* [Elasticsearch Head](https://mobz.github.io/elasticsearch-head/) a web front end for browsing and interacting with an Elastic Search cluster.
|
* [Elasticvue](https://github.com/cars10/elasticvue/) a web front end for browsing and interacting with an Elastic Search cluster.
|
||||||
* [Fatt](https://github.com/0x4D31/fatt) a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic.
|
* [Fatt](https://github.com/0x4D31/fatt) a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic.
|
||||||
* [Spiderfoot](https://github.com/smicallef/spiderfoot) a open source intelligence automation tool.
|
* [Spiderfoot](https://github.com/smicallef/spiderfoot) a open source intelligence automation tool.
|
||||||
* [Suricata](http://suricata-ids.org/) a Network Security Monitoring engine.
|
* [Suricata](http://suricata-ids.org/) a Network Security Monitoring engine.
|
||||||
|
@ -121,7 +121,7 @@ In T-Pot we combine the dockerized honeypots ...
|
||||||
* [Cockpit](https://cockpit-project.org/running) for a lightweight, webui for docker, os, real-time performance monitoring and web terminal.
|
* [Cockpit](https://cockpit-project.org/running) for a lightweight, webui for docker, os, real-time performance monitoring and web terminal.
|
||||||
* [Cyberchef](https://gchq.github.io/CyberChef/) a web app for encryption, encoding, compression and data analysis.
|
* [Cyberchef](https://gchq.github.io/CyberChef/) a web app for encryption, encoding, compression and data analysis.
|
||||||
* [ELK stack](https://www.elastic.co/videos) to beautifully visualize all the events captured by T-Pot.
|
* [ELK stack](https://www.elastic.co/videos) to beautifully visualize all the events captured by T-Pot.
|
||||||
* [Elasticsearch Head](https://mobz.github.io/elasticsearch-head/) a web front end for browsing and interacting with an Elastic Search cluster.
|
* [Elasticvue](https://github.com/cars10/elasticvue/) a web front end for browsing and interacting with an Elastic Search cluster.
|
||||||
* [Fatt](https://github.com/0x4D31/fatt) a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic.
|
* [Fatt](https://github.com/0x4D31/fatt) a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic.
|
||||||
* [Spiderfoot](https://github.com/smicallef/spiderfoot) a open source intelligence automation tool.
|
* [Spiderfoot](https://github.com/smicallef/spiderfoot) a open source intelligence automation tool.
|
||||||
* [Suricata](http://suricata-ids.org/) a Network Security Monitoring engine.
|
* [Suricata](http://suricata-ids.org/) a Network Security Monitoring engine.
|
||||||
|
@ -160,7 +160,7 @@ There are prebuilt installation types available each focussing on different aspe
|
||||||
|
|
||||||
##### Standard
|
##### Standard
|
||||||
- Honeypots: adbhoney, ciscoasa, citrixhoneypot, conpot, cowrie, dicompot, dionaea, elasticpot, heralding, honeysap, honeytrap, mailoney, medpot, rdpy, snare & tanner
|
- Honeypots: adbhoney, ciscoasa, citrixhoneypot, conpot, cowrie, dicompot, dionaea, elasticpot, heralding, honeysap, honeytrap, mailoney, medpot, rdpy, snare & tanner
|
||||||
- Tools: cockpit, cyberchef, ELK, fatt, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
- Tools: cockpit, cyberchef, ELK, fatt, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
||||||
|
|
||||||
|
|
||||||
##### Sensor
|
##### Sensor
|
||||||
|
@ -171,22 +171,22 @@ There are prebuilt installation types available each focussing on different aspe
|
||||||
|
|
||||||
##### Industrial
|
##### Industrial
|
||||||
- Honeypots: conpot, cowrie, dicompot, heralding, honeysap, honeytrap, medpot & rdpy
|
- Honeypots: conpot, cowrie, dicompot, heralding, honeysap, honeytrap, medpot & rdpy
|
||||||
- Tools: cockpit, cyberchef, ELK, fatt, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
- Tools: cockpit, cyberchef, ELK, fatt, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
||||||
|
|
||||||
|
|
||||||
##### Collector
|
##### Collector
|
||||||
- Honeypots: heralding & honeytrap
|
- Honeypots: heralding & honeytrap
|
||||||
- Tools: cockpit, cyberchef, fatt, ELK, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
- Tools: cockpit, cyberchef, fatt, ELK, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
||||||
|
|
||||||
|
|
||||||
##### NextGen
|
##### NextGen
|
||||||
- Honeypots: adbhoney, ciscoasa, citrixhoneypot, conpot, cowrie, dicompot, dionaea, glutton, heralding, honeysap, ipphoney, mailoney, medpot, rdpy, snare & tanner
|
- Honeypots: adbhoney, ciscoasa, citrixhoneypot, conpot, cowrie, dicompot, dionaea, glutton, heralding, honeysap, ipphoney, mailoney, medpot, rdpy, snare & tanner
|
||||||
- Tools: cockpit, cyberchef, ELK, fatt, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
- Tools: cockpit, cyberchef, ELK, fatt, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
||||||
|
|
||||||
|
|
||||||
##### Medical
|
##### Medical
|
||||||
- Honeypots: dicompot & medpot
|
- Honeypots: dicompot & medpot
|
||||||
- Tools: cockpit, cyberchef, ELK, fatt, elasticsearch head, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
- Tools: cockpit, cyberchef, ELK, fatt, elasticvue, ewsposter, nginx / heimdall, spiderfoot, p0f & suricata
|
||||||
|
|
||||||
|
|
||||||
<a name="installation"></a>
|
<a name="installation"></a>
|
||||||
|
@ -419,8 +419,6 @@ The following web based tools are included to improve and ease up daily tasks.
|
||||||
|
|
||||||

|

|
||||||
|
|
||||||

|
|
||||||
|
|
||||||

|

|
||||||
|
|
||||||
|
|
||||||
|
@ -500,8 +498,8 @@ We hope you understand that we cannot provide support on an individual basis. We
|
||||||
The software that T-Pot is built on uses the following licenses.
|
The software that T-Pot is built on uses the following licenses.
|
||||||
<br>GPLv2: [conpot](https://github.com/mushorg/conpot/blob/master/LICENSE.txt), [dionaea](https://github.com/DinoTools/dionaea/blob/master/LICENSE), [honeysap](https://github.com/SecureAuthCorp/HoneySAP/blob/master/COPYING), [honeytrap](https://github.com/armedpot/honeytrap/blob/master/LICENSE), [suricata](http://suricata-ids.org/about/open-source/)
|
<br>GPLv2: [conpot](https://github.com/mushorg/conpot/blob/master/LICENSE.txt), [dionaea](https://github.com/DinoTools/dionaea/blob/master/LICENSE), [honeysap](https://github.com/SecureAuthCorp/HoneySAP/blob/master/COPYING), [honeytrap](https://github.com/armedpot/honeytrap/blob/master/LICENSE), [suricata](http://suricata-ids.org/about/open-source/)
|
||||||
<br>GPLv3: [adbhoney](https://github.com/huuck/ADBHoney), [elasticpot](https://gitlab.com/bontchev/elasticpot/-/blob/master/LICENSE), [ewsposter](https://github.com/telekom-security/ews/), [log4pot](https://github.com/thomaspatzke/Log4Pot/blob/master/LICENSE), [fatt](https://github.com/0x4D31/fatt/blob/master/LICENSE), [rdpy](https://github.com/citronneur/rdpy/blob/master/LICENSE), [heralding](https://github.com/johnnykv/heralding/blob/master/LICENSE.txt), [ipphoney](https://gitlab.com/bontchev/ipphoney/-/blob/master/LICENSE), [redishoneypot](https://github.com/cypwnpwnsocute/RedisHoneyPot/blob/main/LICENSE), [snare](https://github.com/mushorg/snare/blob/master/LICENSE), [tanner](https://github.com/mushorg/snare/blob/master/LICENSE)
|
<br>GPLv3: [adbhoney](https://github.com/huuck/ADBHoney), [elasticpot](https://gitlab.com/bontchev/elasticpot/-/blob/master/LICENSE), [ewsposter](https://github.com/telekom-security/ews/), [log4pot](https://github.com/thomaspatzke/Log4Pot/blob/master/LICENSE), [fatt](https://github.com/0x4D31/fatt/blob/master/LICENSE), [rdpy](https://github.com/citronneur/rdpy/blob/master/LICENSE), [heralding](https://github.com/johnnykv/heralding/blob/master/LICENSE.txt), [ipphoney](https://gitlab.com/bontchev/ipphoney/-/blob/master/LICENSE), [redishoneypot](https://github.com/cypwnpwnsocute/RedisHoneyPot/blob/main/LICENSE), [snare](https://github.com/mushorg/snare/blob/master/LICENSE), [tanner](https://github.com/mushorg/snare/blob/master/LICENSE)
|
||||||
<br>Apache 2 License: [cyberchef](https://github.com/gchq/CyberChef/blob/master/LICENSE), [dicompot](https://github.com/nsmfoo/dicompot/blob/master/LICENSE), [elasticsearch](https://github.com/elasticsearch/elasticsearch/blob/master/LICENSE.txt), [logstash](https://github.com/elasticsearch/logstash/blob/master/LICENSE), [kibana](https://github.com/elasticsearch/kibana/blob/master/LICENSE.md), [docker](https://github.com/docker/docker/blob/master/LICENSE), [elasticsearch-head](https://github.com/mobz/elasticsearch-head/blob/master/LICENCE)
|
<br>Apache 2 License: [cyberchef](https://github.com/gchq/CyberChef/blob/master/LICENSE), [dicompot](https://github.com/nsmfoo/dicompot/blob/master/LICENSE), [elasticsearch](https://github.com/elasticsearch/elasticsearch/blob/master/LICENSE.txt), [logstash](https://github.com/elasticsearch/logstash/blob/master/LICENSE), [kibana](https://github.com/elasticsearch/kibana/blob/master/LICENSE.md), [docker](https://github.com/docker/docker/blob/master/LICENSE)
|
||||||
<br>MIT license: [ciscoasa](https://github.com/Cymmetria/ciscoasa_honeypot/blob/master/LICENSE), [ddospot](https://github.com/aelth/ddospot/blob/master/LICENSE), [glutton](https://github.com/mushorg/glutton/blob/master/LICENSE), [hellpot](https://github.com/yunginnanet/HellPot/blob/master/LICENSE)
|
<br>MIT license: [ciscoasa](https://github.com/Cymmetria/ciscoasa_honeypot/blob/master/LICENSE), [ddospot](https://github.com/aelth/ddospot/blob/master/LICENSE), [elasticvue](https://github.com/cars10/elasticvue/blob/master/LICENSE), [glutton](https://github.com/mushorg/glutton/blob/master/LICENSE), [hellpot](https://github.com/yunginnanet/HellPot/blob/master/LICENSE)
|
||||||
<br> Unlicense: [endlessh](https://github.com/skeeto/endlessh/blob/master/UNLICENSE)
|
<br> Unlicense: [endlessh](https://github.com/skeeto/endlessh/blob/master/UNLICENSE)
|
||||||
<br> Other: [citrixhoneypot](https://github.com/MalwareTech/CitrixHoneypot#licencing-agreement-malwaretech-public-licence), [cowrie](https://github.com/micheloosterhof/cowrie/blob/master/LICENSE.md), [mailoney](https://github.com/awhitehatter/mailoney), [Debian licensing](https://www.debian.org/legal/licenses/), [Elastic License](https://www.elastic.co/licensing/elastic-license)
|
<br> Other: [citrixhoneypot](https://github.com/MalwareTech/CitrixHoneypot#licencing-agreement-malwaretech-public-licence), [cowrie](https://github.com/micheloosterhof/cowrie/blob/master/LICENSE.md), [mailoney](https://github.com/awhitehatter/mailoney), [Debian licensing](https://www.debian.org/legal/licenses/), [Elastic License](https://www.elastic.co/licensing/elastic-license)
|
||||||
<br> AGPL-3.0: [honeypots](https://github.com/qeeqbox/honeypots/blob/main/LICENSE)
|
<br> AGPL-3.0: [honeypots](https://github.com/qeeqbox/honeypots/blob/main/LICENSE)
|
||||||
|
@ -527,7 +525,7 @@ Without open source and the fruitful development community (we are proud to be a
|
||||||
* [docker](https://github.com/docker/docker/graphs/contributors)
|
* [docker](https://github.com/docker/docker/graphs/contributors)
|
||||||
* [elasticpot](https://gitlab.com/bontchev/elasticpot/-/project_members)
|
* [elasticpot](https://gitlab.com/bontchev/elasticpot/-/project_members)
|
||||||
* [elasticsearch](https://github.com/elastic/elasticsearch/graphs/contributors)
|
* [elasticsearch](https://github.com/elastic/elasticsearch/graphs/contributors)
|
||||||
* [elasticsearch-head](https://github.com/mobz/elasticsearch-head/graphs/contributors)
|
* [elasticvue](https://github.com/cars10/elasticvue/graphs/contributors)
|
||||||
* [endlessh](https://github.com/skeeto/endlessh/graphs/contributors)
|
* [endlessh](https://github.com/skeeto/endlessh/graphs/contributors)
|
||||||
* [ewsposter](https://github.com/armedpot/ewsposter/graphs/contributors)
|
* [ewsposter](https://github.com/armedpot/ewsposter/graphs/contributors)
|
||||||
* [fatt](https://github.com/0x4D31/fatt/graphs/contributors)
|
* [fatt](https://github.com/0x4D31/fatt/graphs/contributors)
|
||||||
|
|
|
@ -179,11 +179,6 @@ services:
|
||||||
build: elk/logstash/.
|
build: elk/logstash/.
|
||||||
image: "dtagdevsec/logstash:2203"
|
image: "dtagdevsec/logstash:2203"
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
build: elk/head/.
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
|
|
||||||
# Ewsposter service
|
# Ewsposter service
|
||||||
ewsposter:
|
ewsposter:
|
||||||
build: ews/.
|
build: ews/.
|
||||||
|
|
|
@ -57,16 +57,3 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- /data:/data
|
- /data:/data
|
||||||
# - /root/tpotce/docker/elk/logstash/dist/logstash.conf:/etc/logstash/conf.d/logstash.conf
|
# - /root/tpotce/docker/elk/logstash/dist/logstash.conf:/etc/logstash/conf.d/logstash.conf
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
build: head/.
|
|
||||||
container_name: head
|
|
||||||
restart: always
|
|
||||||
depends_on:
|
|
||||||
elasticsearch:
|
|
||||||
condition: service_healthy
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:64302:9100"
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
read_only: true
|
|
||||||
|
|
|
@ -39,12 +39,14 @@ RUN apk -U --no-cache add \
|
||||||
php7 artisan key:generate && \
|
php7 artisan key:generate && \
|
||||||
#
|
#
|
||||||
## Add previously configured content
|
## Add previously configured content
|
||||||
mkdir -p /var/lib/nginx/html/storage/app/public/backgrounds/ && \
|
mkdir -p /var/lib/nginx/html/storage/app/public/backgrounds/ \
|
||||||
|
/var/lib/nginx/html/esvue && \
|
||||||
|
tar xvfz /root/dist/esvue.tgz -C /var/lib/nginx/html/esvue && \
|
||||||
cp /root/dist/app/bg1.jpg /var/lib/nginx/html/public/img/bg1.jpg && \
|
cp /root/dist/app/bg1.jpg /var/lib/nginx/html/public/img/bg1.jpg && \
|
||||||
cp /root/dist/app/t-pot.png /var/lib/nginx/html/public/img/heimdall-icon-small.png && \
|
cp /root/dist/app/t-pot.png /var/lib/nginx/html/public/img/heimdall-icon-small.png && \
|
||||||
cp /root/dist/app/app.sqlite /var/lib/nginx/html/database/app.sqlite && \
|
cp /root/dist/app/app.sqlite /var/lib/nginx/html/database/app.sqlite && \
|
||||||
cp /root/dist/app/cyberchef.png /var/lib/nginx/html/storage/app/public/icons/ZotKKZA2QKplZhdoF3WLx4UdKKhLFamf3lSMcLkr.png && \
|
cp /root/dist/app/cyberchef.png /var/lib/nginx/html/storage/app/public/icons/ZotKKZA2QKplZhdoF3WLx4UdKKhLFamf3lSMcLkr.png && \
|
||||||
cp /root/dist/app/eshead.png /var/lib/nginx/html/storage/app/public/icons/77KqFv4YIshXUDLDoOvZ1NUbsKDtsMAjJvg4sYqN.png && \
|
cp /root/dist/app/esvue.png /var/lib/nginx/html/storage/app/public/icons/3aLDl0Kq42sTHSpIrJtmrOTThpvHoL0Zk2Ay13YT.png && \
|
||||||
cp /root/dist/app/tsec.png /var/lib/nginx/html/storage/app/public/icons/RHwXCfCeGNDdhYgzlShL9o4NBFL2LHZWajgyeL0a.png && \
|
cp /root/dist/app/tsec.png /var/lib/nginx/html/storage/app/public/icons/RHwXCfCeGNDdhYgzlShL9o4NBFL2LHZWajgyeL0a.png && \
|
||||||
cp /root/dist/app/spiderfoot.png /var/lib/nginx/html/storage/app/public/icons/s7uPe1frJqjv76oI6SNqNbWUsgU1GHYqRALMlwYb.png && \
|
cp /root/dist/app/spiderfoot.png /var/lib/nginx/html/storage/app/public/icons/s7uPe1frJqjv76oI6SNqNbWUsgU1GHYqRALMlwYb.png && \
|
||||||
cp /root/dist/html/*.html /var/lib/nginx/html/public/ && \
|
cp /root/dist/html/*.html /var/lib/nginx/html/public/ && \
|
||||||
|
|
BIN
docker/heimdall/dist/app/app.sqlite
vendored
BIN
docker/heimdall/dist/app/app.sqlite
vendored
Binary file not shown.
BIN
docker/heimdall/dist/app/eshead.png
vendored
BIN
docker/heimdall/dist/app/eshead.png
vendored
Binary file not shown.
Before Width: | Height: | Size: 13 KiB |
BIN
docker/heimdall/dist/app/esvue.png
vendored
Normal file
BIN
docker/heimdall/dist/app/esvue.png
vendored
Normal file
Binary file not shown.
After Width: | Height: | Size: 2.8 KiB |
12
docker/heimdall/dist/conf/tpotweb.conf
vendored
12
docker/heimdall/dist/conf/tpotweb.conf
vendored
|
@ -96,6 +96,12 @@ server {
|
||||||
try_files $uri $uri/ /index.php?$query_string;
|
try_files $uri $uri/ /index.php?$query_string;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
location ^~ /elasticvue {
|
||||||
|
index index.html;
|
||||||
|
alias /var/lib/nginx/html/esvue;
|
||||||
|
try_files $uri $uri/ /index.html?$args;
|
||||||
|
}
|
||||||
|
|
||||||
location ~ \.php$ {
|
location ~ \.php$ {
|
||||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||||
fastcgi_pass 127.0.0.1:64304;
|
fastcgi_pass 127.0.0.1:64304;
|
||||||
|
@ -120,12 +126,6 @@ server {
|
||||||
rewrite /es/(.*)$ /$1 break;
|
rewrite /es/(.*)$ /$1 break;
|
||||||
}
|
}
|
||||||
|
|
||||||
### head standalone
|
|
||||||
location /myhead/ {
|
|
||||||
proxy_pass http://127.0.0.1:64302/;
|
|
||||||
rewrite /myhead/(.*)$ /$1 break;
|
|
||||||
}
|
|
||||||
|
|
||||||
### CyberChef
|
### CyberChef
|
||||||
location /cyberchef {
|
location /cyberchef {
|
||||||
proxy_pass http://127.0.0.1:64299;
|
proxy_pass http://127.0.0.1:64299;
|
||||||
|
|
BIN
docker/heimdall/dist/esvue.tgz
vendored
Normal file
BIN
docker/heimdall/dist/esvue.tgz
vendored
Normal file
Binary file not shown.
|
@ -27,7 +27,7 @@ services:
|
||||||
- "64297:64297"
|
- "64297:64297"
|
||||||
- "127.0.0.1:64304:64304"
|
- "127.0.0.1:64304:64304"
|
||||||
image: "dtagdevsec/nginx:2203"
|
image: "dtagdevsec/nginx:2203"
|
||||||
read_only: true
|
# read_only: true
|
||||||
volumes:
|
volumes:
|
||||||
- /data/nginx/cert/:/etc/nginx/cert/:ro
|
- /data/nginx/cert/:/etc/nginx/cert/:ro
|
||||||
- /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
|
- /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
|
||||||
|
|
|
@ -28,8 +28,8 @@ RUN apk -U add \
|
||||||
mkdir -p /opt \
|
mkdir -p /opt \
|
||||||
/var/log/honeypots && \
|
/var/log/honeypots && \
|
||||||
cd /opt/ && \
|
cd /opt/ && \
|
||||||
#git clone https://github.com/qeeqbox/honeypots && \
|
git clone https://github.com/qeeqbox/honeypots && \
|
||||||
git clone https://github.com/t3chn0m4g3/honeypots && \
|
#git clone https://github.com/t3chn0m4g3/honeypots && \
|
||||||
cd honeypots && \
|
cd honeypots && \
|
||||||
#git checkout 7c654a3ef2c564ae6f1247bf302d652037080163 && \
|
#git checkout 7c654a3ef2c564ae6f1247bf302d652037080163 && \
|
||||||
pip3 install --upgrade pip && \
|
pip3 install --upgrade pip && \
|
||||||
|
@ -61,4 +61,4 @@ RUN apk -U add \
|
||||||
STOPSIGNAL SIGINT
|
STOPSIGNAL SIGINT
|
||||||
USER honeypots:honeypots
|
USER honeypots:honeypots
|
||||||
WORKDIR /opt/honeypots/
|
WORKDIR /opt/honeypots/
|
||||||
CMD python3 -m honeypots --setup all --config config.json
|
CMD python3 -E -m honeypots --setup all --config config.json
|
||||||
|
|
359
docker/honeypots/dist/config.json
vendored
359
docker/honeypots/dist/config.json
vendored
|
@ -1,144 +1,219 @@
|
||||||
{
|
{
|
||||||
"logs":"file,terminal",
|
"logs": "file,terminal,json,tpot",
|
||||||
"logs_location":"/var/log/honeypots/",
|
"logs_location":"/var/log/honeypots/",
|
||||||
"honeypots": {
|
"syslog_address": "",
|
||||||
"dns": {
|
"syslog_facility": 0,
|
||||||
"port": 53,
|
"postgres": "",
|
||||||
"ip": "0.0.0.0",
|
"db_options": [],
|
||||||
"username": "administrator",
|
"filter": "",
|
||||||
"password": "123456"
|
"interface": "",
|
||||||
},
|
"honeypots": {
|
||||||
"ftp": {
|
"dns": {
|
||||||
"port": 21,
|
"port": 53,
|
||||||
"ip": "0.0.0.0",
|
"ip": "0.0.0.0",
|
||||||
"username": "ftp",
|
"username": "administrator",
|
||||||
"password": "anonymous"
|
"password": "123456",
|
||||||
},
|
"log_file_name": "dns.log",
|
||||||
"httpproxy": {
|
"max_bytes": 10000,
|
||||||
"port": 8080,
|
"backup_count": 10
|
||||||
"ip": "0.0.0.0",
|
},
|
||||||
"username": "admin",
|
"ftp": {
|
||||||
"password": "admin"
|
"port": 21,
|
||||||
},
|
"ip": "0.0.0.0",
|
||||||
"http": {
|
"username": "ftp",
|
||||||
"port": 80,
|
"password": "anonymous",
|
||||||
"ip": "0.0.0.0",
|
"log_file_name": "ftp.log",
|
||||||
"username": "admin",
|
"max_bytes": 10000,
|
||||||
"password": "admin"
|
"backup_count": 10
|
||||||
},
|
},
|
||||||
"https": {
|
"httpproxy": {
|
||||||
"port": 443,
|
"port": 8080,
|
||||||
"ip": "0.0.0.0",
|
"ip": "0.0.0.0",
|
||||||
"username": "admin",
|
"username": "admin",
|
||||||
"password": "admin"
|
"password": "admin",
|
||||||
},
|
"log_file_name": "httpproxy.log",
|
||||||
"imap": {
|
"max_bytes": 10000,
|
||||||
"port": 143,
|
"backup_count": 10
|
||||||
"ip": "0.0.0.0",
|
},
|
||||||
"username": "root",
|
"http": {
|
||||||
"password": "123456"
|
"port": 80,
|
||||||
},
|
"ip": "0.0.0.0",
|
||||||
"mysql": {
|
"username": "admin",
|
||||||
"port": 3306,
|
"password": "admin",
|
||||||
"ip": "0.0.0.0",
|
"log_file_name": "http.log",
|
||||||
"username": "root",
|
"max_bytes": 10000,
|
||||||
"password": "123456"
|
"backup_count": 10
|
||||||
},
|
},
|
||||||
"pop3": {
|
"https": {
|
||||||
"port": 110,
|
"port": 443,
|
||||||
"ip": "0.0.0.0",
|
"ip": "0.0.0.0",
|
||||||
"username": "root",
|
"username": "admin",
|
||||||
"password": "123456"
|
"password": "admin",
|
||||||
},
|
"log_file_name": "https.log",
|
||||||
"postgres": {
|
"max_bytes": 10000,
|
||||||
"port": 5432,
|
"backup_count": 10
|
||||||
"ip": "0.0.0.0",
|
},
|
||||||
"username": "postgres",
|
"imap": {
|
||||||
"password": "123456"
|
"port": 143,
|
||||||
},
|
"ip": "0.0.0.0",
|
||||||
"redis": {
|
"username": "root",
|
||||||
"port": 6379,
|
"password": "123456",
|
||||||
"ip": "0.0.0.0",
|
"log_file_name": "imap.log",
|
||||||
"username": "root",
|
"max_bytes": 10000,
|
||||||
"password": ""
|
"backup_count": 10
|
||||||
},
|
},
|
||||||
"smb": {
|
"mysql": {
|
||||||
"port": 445,
|
"port": 3306,
|
||||||
"ip": "0.0.0.0",
|
"ip": "0.0.0.0",
|
||||||
"username": "administrator",
|
"username": "root",
|
||||||
"password": "123456"
|
"password": "123456",
|
||||||
},
|
"log_file_name": "mysql.log",
|
||||||
"smtp": {
|
"max_bytes": 10000,
|
||||||
"port": 25,
|
"backup_count": 10
|
||||||
"ip": "0.0.0.0",
|
},
|
||||||
"username": "root",
|
"pop3": {
|
||||||
"password": "123456"
|
"port": 110,
|
||||||
},
|
"ip": "0.0.0.0",
|
||||||
"socks5": {
|
"username": "root",
|
||||||
"port": 1080,
|
"password": "123456",
|
||||||
"ip": "0.0.0.0",
|
"log_file_name": "pop3.log",
|
||||||
"username": "admin",
|
"max_bytes": 10000,
|
||||||
"password": "admin"
|
"backup_count": 10
|
||||||
},
|
},
|
||||||
"ssh": {
|
"postgres": {
|
||||||
"port": 22,
|
"port": 5432,
|
||||||
"ip": "0.0.0.0",
|
"ip": "0.0.0.0",
|
||||||
"username": "root",
|
"username": "postgres",
|
||||||
"password": "123456"
|
"password": "123456",
|
||||||
},
|
"log_file_name": "postgres.log",
|
||||||
"telnet": {
|
"max_bytes": 10000,
|
||||||
"port": 23,
|
"backup_count": 10
|
||||||
"ip": "0.0.0.0",
|
},
|
||||||
"username": "root",
|
"redis": {
|
||||||
"password": "123456"
|
"port": 6379,
|
||||||
},
|
"ip": "0.0.0.0",
|
||||||
"vnc": {
|
"username": "root",
|
||||||
"port": 5900,
|
"password": "",
|
||||||
"ip": "0.0.0.0",
|
"log_file_name": "redis.log",
|
||||||
"username": "administrator",
|
"max_bytes": 10000,
|
||||||
"password": "123456"
|
"backup_count": 10
|
||||||
},
|
},
|
||||||
"elastic": {
|
"smb": {
|
||||||
"port": 9200,
|
"port": 445,
|
||||||
"ip": "0.0.0.0",
|
"ip": "0.0.0.0",
|
||||||
"username": "elastic",
|
"username": "administrator",
|
||||||
"password": "123456"
|
"password": "123456",
|
||||||
},
|
"log_file_name": "smb.log",
|
||||||
"mssql": {
|
"max_bytes": 10000,
|
||||||
"port": 1433,
|
"backup_count": 10
|
||||||
"ip": "0.0.0.0",
|
},
|
||||||
"username": "sa",
|
"smtp": {
|
||||||
"password": ""
|
"port": 25,
|
||||||
},
|
"ip": "0.0.0.0",
|
||||||
"ldap": {
|
"username": "root",
|
||||||
"port": 389,
|
"password": "123456",
|
||||||
"ip": "0.0.0.0",
|
"log_file_name": "smtp.log",
|
||||||
"username": "administrator",
|
"max_bytes": 10000,
|
||||||
"password": "123456"
|
"backup_count": 10
|
||||||
},
|
},
|
||||||
"ntp": {
|
"socks5": {
|
||||||
"port": 123,
|
"port": 1080,
|
||||||
"ip": "0.0.0.0",
|
"ip": "0.0.0.0",
|
||||||
"username": "administrator",
|
"username": "admin",
|
||||||
"password": "123456"
|
"password": "admin",
|
||||||
},
|
"log_file_name": "socks5.log",
|
||||||
"memcache": {
|
"max_bytes": 10000,
|
||||||
"port": 11211,
|
"backup_count": 10
|
||||||
"ip": "0.0.0.0",
|
},
|
||||||
"username": "admin",
|
"ssh": {
|
||||||
"password": "123456"
|
"port": 22,
|
||||||
},
|
"ip": "0.0.0.0",
|
||||||
"oracle": {
|
"username": "root",
|
||||||
"port": 1521,
|
"password": "123456",
|
||||||
"ip": "0.0.0.0",
|
"log_file_name": "ssh.log",
|
||||||
"username": "bi",
|
"max_bytes": 10000,
|
||||||
"password": "123456"
|
"backup_count": 10
|
||||||
},
|
},
|
||||||
"snmp": {
|
"telnet": {
|
||||||
"port": 161,
|
"port": 23,
|
||||||
"ip": "0.0.0.0",
|
"ip": "0.0.0.0",
|
||||||
"username": "privUser",
|
"username": "root",
|
||||||
"password": "123456"
|
"password": "123456",
|
||||||
}
|
"log_file_name": "telnet.log",
|
||||||
}
|
"max_bytes": 10000,
|
||||||
|
"backup_count": 10
|
||||||
|
},
|
||||||
|
"vnc": {
|
||||||
|
"port": 5900,
|
||||||
|
"ip": "0.0.0.0",
|
||||||
|
"username": "administrator",
|
||||||
|
"password": "123456",
|
||||||
|
"log_file_name": "vnc.log",
|
||||||
|
"max_bytes": 10000,
|
||||||
|
"backup_count": 10
|
||||||
|
},
|
||||||
|
"elastic": {
|
||||||
|
"port": 9200,
|
||||||
|
"ip": "0.0.0.0",
|
||||||
|
"username": "elastic",
|
||||||
|
"password": "123456",
|
||||||
|
"log_file_name": "elastic.log",
|
||||||
|
"max_bytes": 10000,
|
||||||
|
"backup_count": 10
|
||||||
|
},
|
||||||
|
"mssql": {
|
||||||
|
"port": 1433,
|
||||||
|
"ip": "0.0.0.0",
|
||||||
|
"username": "sa",
|
||||||
|
"password": "",
|
||||||
|
"log_file_name": "mssql.log",
|
||||||
|
"max_bytes": 10000,
|
||||||
|
"backup_count": 10
|
||||||
|
},
|
||||||
|
"ldap": {
|
||||||
|
"port": 389,
|
||||||
|
"ip": "0.0.0.0",
|
||||||
|
"username": "administrator",
|
||||||
|
"password": "123456",
|
||||||
|
"log_file_name": "ldap.log",
|
||||||
|
"max_bytes": 10000,
|
||||||
|
"backup_count": 10
|
||||||
|
},
|
||||||
|
"ntp": {
|
||||||
|
"port": 123,
|
||||||
|
"ip": "0.0.0.0",
|
||||||
|
"username": "administrator",
|
||||||
|
"password": "123456",
|
||||||
|
"log_file_name": "ntp.log",
|
||||||
|
"max_bytes": 10000,
|
||||||
|
"backup_count": 10
|
||||||
|
},
|
||||||
|
"memcache": {
|
||||||
|
"port": 11211,
|
||||||
|
"ip": "0.0.0.0",
|
||||||
|
"username": "admin",
|
||||||
|
"password": "123456",
|
||||||
|
"log_file_name": "memcache.log",
|
||||||
|
"max_bytes": 10000,
|
||||||
|
"backup_count": 10
|
||||||
|
},
|
||||||
|
"oracle": {
|
||||||
|
"port": 1521,
|
||||||
|
"ip": "0.0.0.0",
|
||||||
|
"username": "bi",
|
||||||
|
"password": "123456",
|
||||||
|
"log_file_name": "oracle.log",
|
||||||
|
"max_bytes": 10000,
|
||||||
|
"backup_count": 10
|
||||||
|
},
|
||||||
|
"snmp": {
|
||||||
|
"port": 161,
|
||||||
|
"ip": "0.0.0.0",
|
||||||
|
"username": "privUser",
|
||||||
|
"password": "123456",
|
||||||
|
"log_file_name": "snmp.log",
|
||||||
|
"max_bytes": 10000,
|
||||||
|
"backup_count": 10
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -175,18 +175,6 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- /data:/data
|
- /data:/data
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
container_name: head
|
|
||||||
restart: always
|
|
||||||
depends_on:
|
|
||||||
elasticsearch:
|
|
||||||
condition: service_healthy
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:64302:9100"
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
read_only: true
|
|
||||||
|
|
||||||
# Ewsposter service
|
# Ewsposter service
|
||||||
ewsposter:
|
ewsposter:
|
||||||
container_name: ewsposter
|
container_name: ewsposter
|
||||||
|
|
|
@ -76,18 +76,6 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- /data:/data
|
- /data:/data
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
container_name: head
|
|
||||||
restart: always
|
|
||||||
depends_on:
|
|
||||||
elasticsearch:
|
|
||||||
condition: service_healthy
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:64302:9100"
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
read_only: true
|
|
||||||
|
|
||||||
# Nginx service
|
# Nginx service
|
||||||
nginx:
|
nginx:
|
||||||
container_name: nginx
|
container_name: nginx
|
||||||
|
|
|
@ -382,18 +382,6 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- /data:/data
|
- /data:/data
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
container_name: head
|
|
||||||
restart: always
|
|
||||||
depends_on:
|
|
||||||
elasticsearch:
|
|
||||||
condition: service_healthy
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:64302:9100"
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
read_only: true
|
|
||||||
|
|
||||||
# Ewsposter service
|
# Ewsposter service
|
||||||
ewsposter:
|
ewsposter:
|
||||||
container_name: ewsposter
|
container_name: ewsposter
|
||||||
|
|
|
@ -165,18 +165,6 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- /data:/data
|
- /data:/data
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
container_name: head
|
|
||||||
restart: always
|
|
||||||
depends_on:
|
|
||||||
elasticsearch:
|
|
||||||
condition: service_healthy
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:64302:9100"
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
read_only: true
|
|
||||||
|
|
||||||
# Ewsposter service
|
# Ewsposter service
|
||||||
ewsposter:
|
ewsposter:
|
||||||
container_name: ewsposter
|
container_name: ewsposter
|
||||||
|
|
|
@ -159,18 +159,6 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- /data:/data
|
- /data:/data
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
container_name: head
|
|
||||||
restart: always
|
|
||||||
depends_on:
|
|
||||||
elasticsearch:
|
|
||||||
condition: service_healthy
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:64302:9100"
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
read_only: true
|
|
||||||
|
|
||||||
# Ewsposter service
|
# Ewsposter service
|
||||||
ewsposter:
|
ewsposter:
|
||||||
container_name: ewsposter
|
container_name: ewsposter
|
||||||
|
|
|
@ -184,18 +184,6 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- /data:/data
|
- /data:/data
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
container_name: head
|
|
||||||
restart: always
|
|
||||||
depends_on:
|
|
||||||
elasticsearch:
|
|
||||||
condition: service_healthy
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:64302:9100"
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
read_only: true
|
|
||||||
|
|
||||||
# Ewsposter service
|
# Ewsposter service
|
||||||
ewsposter:
|
ewsposter:
|
||||||
container_name: ewsposter
|
container_name: ewsposter
|
||||||
|
|
|
@ -525,18 +525,6 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- /data:/data
|
- /data:/data
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
container_name: head
|
|
||||||
restart: always
|
|
||||||
depends_on:
|
|
||||||
elasticsearch:
|
|
||||||
condition: service_healthy
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:64302:9100"
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
read_only: true
|
|
||||||
|
|
||||||
# Ewsposter service
|
# Ewsposter service
|
||||||
ewsposter:
|
ewsposter:
|
||||||
container_name: ewsposter
|
container_name: ewsposter
|
||||||
|
|
|
@ -558,18 +558,6 @@ services:
|
||||||
volumes:
|
volumes:
|
||||||
- /data:/data
|
- /data:/data
|
||||||
|
|
||||||
## Elasticsearch-head service
|
|
||||||
head:
|
|
||||||
container_name: head
|
|
||||||
restart: always
|
|
||||||
depends_on:
|
|
||||||
elasticsearch:
|
|
||||||
condition: service_healthy
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:64302:9100"
|
|
||||||
image: "dtagdevsec/head:2203"
|
|
||||||
read_only: true
|
|
||||||
|
|
||||||
# Ewsposter service
|
# Ewsposter service
|
||||||
ewsposter:
|
ewsposter:
|
||||||
container_name: ewsposter
|
container_name: ewsposter
|
||||||
|
|
Loading…
Reference in a new issue