mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-08-27 21:36:20 +00:00
Update README.md
This commit is contained in:
Domenico Del Giudice
GitHub
parent
07d677705c
commit
b06052f4eb
1 changed files with 45 additions and 53 deletions
98
README.md
98
README.md
|
|
@ -8,13 +8,12 @@
|
||||||
- [Architecture](#architecture)
|
- [Architecture](#architecture)
|
||||||
- [Supported Honeypots](#supported-honeypots)
|
- [Supported Honeypots](#supported-honeypots)
|
||||||
- [Tools Included](#tools-included)
|
- [Tools Included](#tools-included)
|
||||||
|
- [Required Ports](#required-ports)
|
||||||
- [MacOS Installation](#macos-installation)
|
- [MacOS Installation](#macos-installation)
|
||||||
- [Installation Issues](#installation-issues)
|
- [Installation Issues](#installation-issues)
|
||||||
- [Management Tips](#management-tips)
|
- [Management Tips](#management-tips)
|
||||||
- [Testing ConPot](#testing-conpot)
|
- [Testing ConPot](#testing-conpot)
|
||||||
- [Required Ports](#required-ports)
|
|
||||||
- [Update Script](#update-script)
|
- [Update Script](#update-script)
|
||||||
- [Uninstall T-Pot](#uninstall-tpot)
|
|
||||||
- [Data Analysis and Insights](#data-analysis-and-insights)
|
- [Data Analysis and Insights](#data-analysis-and-insights)
|
||||||
- [Conclusion](#conclusion)
|
- [Conclusion](#conclusion)
|
||||||
|
|
||||||
|
|
@ -98,6 +97,50 @@ T-Pot also includes the following tools:
|
||||||
- **Spiderfoot**: An open-source intelligence automation tool.
|
- **Spiderfoot**: An open-source intelligence automation tool.
|
||||||
- **Suricata**: A Network Security Monitoring engine.
|
- **Suricata**: A Network Security Monitoring engine.
|
||||||
|
|
||||||
|
---
|
||||||
|
<a name="required-ports"></a>
|
||||||
|
### 2.4 Required Ports 🔌
|
||||||
|
Besides the ports generally needed by the OS, i.e. obtaining a DHCP lease, DNS, etc. T-Pot will require the following ports for incoming / outgoing connections. Review the [T-Pot Architecture](#technical-architecture) for a visual representation. Also some ports will show up as duplicates, which is fine since used in different editions.
|
||||||
|
|
||||||
|
| Port | Protocol | Direction | Description |
|
||||||
|
| :------------------------------------------------------------------------------------------------------------------------------------ | :------- | :-------- | :-------------------------------------------------------------------------------------------------- |
|
||||||
|
| 80, 443 | tcp | outgoing | T-Pot Management: Install, Updates, Logs (i.e. OS, GitHub, DockerHub, Sicherheitstacho, etc. |
|
||||||
|
| 11434 | tcp | outgoing | LLM based honeypots: Access your Ollama installation |
|
||||||
|
| 64294 | tcp | incoming | T-Pot Management: Sensor data transmission to hive (through NGINX reverse proxy) to 127.0.0.1:64305 |
|
||||||
|
| 64295 | tcp | incoming | T-Pot Management: Access to SSH |
|
||||||
|
| 64297 | tcp | incoming | T-Pot Management Access to NGINX reverse proxy |
|
||||||
|
| 5555 | tcp | incoming | Honeypot: ADBHoney |
|
||||||
|
| 22 | tcp | incoming | Honeypot: Beelzebub (LLM required) |
|
||||||
|
| 5000 | udp | incoming | Honeypot: CiscoASA |
|
||||||
|
| 8443 | tcp | incoming | Honeypot: CiscoASA |
|
||||||
|
| 443 | tcp | incoming | Honeypot: CitrixHoneypot |
|
||||||
|
| 80, 102, 502, 1025, 2404, 10001, 44818, 47808, 50100 | tcp | incoming | Honeypot: Conpot |
|
||||||
|
| 161, 623 | udp | incoming | Honeypot: Conpot |
|
||||||
|
| 22, 23 | tcp | incoming | Honeypot: Cowrie |
|
||||||
|
| 19, 53, 123, 1900 | udp | incoming | Honeypot: Ddospot |
|
||||||
|
| 11112 | tcp | incoming | Honeypot: Dicompot |
|
||||||
|
| 21, 42, 135, 443, 445, 1433, 1723, 1883, 3306, 8081 | tcp | incoming | Honeypot: Dionaea |
|
||||||
|
| 69 | udp | incoming | Honeypot: Dionaea |
|
||||||
|
| 9200 | tcp | incoming | Honeypot: Elasticpot |
|
||||||
|
| 22 | tcp | incoming | Honeypot: Endlessh |
|
||||||
|
| 80, 443, 8080, 8443 | tcp | incoming | Honeypot: Galah (LLM required) |
|
||||||
|
| 8080 | tcp | incoming | Honeypot: Go-pot |
|
||||||
|
| 80, 443 | tcp | incoming | Honeypot: H0neytr4p |
|
||||||
|
| 21, 22, 23, 25, 80, 110, 143, 443, 993, 995, 1080, 5432, 5900 | tcp | incoming | Honeypot: Heralding |
|
||||||
|
| 3000 | tcp | incoming | Honeypot: Honeyaml |
|
||||||
|
| 21, 22, 23, 25, 80, 110, 143, 389, 443, 445, 631, 1080, 1433, 1521, 3306, 3389, 5060, 5432, 5900, 6379, 6667, 8080, 9100, 9200, 11211 | tcp | incoming | Honeypot: qHoneypots |
|
||||||
|
| 53, 123, 161, 5060 | udp | incoming | Honeypot: qHoneypots |
|
||||||
|
| 631 | tcp | incoming | Honeypot: IPPHoney |
|
||||||
|
| 80, 443, 8080, 9200, 25565 | tcp | incoming | Honeypot: Log4Pot |
|
||||||
|
| 25 | tcp | incoming | Honeypot: Mailoney |
|
||||||
|
| 2575 | tcp | incoming | Honeypot: Medpot |
|
||||||
|
| 9100 | tcp | incoming | Honeypot: Miniprint |
|
||||||
|
| 6379 | tcp | incoming | Honeypot: Redishoneypot |
|
||||||
|
| 5060 | tcp/udp | incoming | Honeypot: SentryPeer |
|
||||||
|
| 80 | tcp | incoming | Honeypot: Snare (Tanner) |
|
||||||
|
| 8090 | tcp | incoming | Honeypot: Wordpot |
|
||||||
|
|
||||||
|
|
||||||
---
|
---
|
||||||
<a name="macos-installation"></a>
|
<a name="macos-installation"></a>
|
||||||
## 2 MacOS Installation 🍏
|
## 2 MacOS Installation 🍏
|
||||||
|
|
@ -390,49 +433,6 @@ sqlmap -u "http://<indirizzo-IP>/page?id=1" --risk=3 --level=5
|
||||||
nc -v <indirizzo-IP> 80
|
nc -v <indirizzo-IP> 80
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
|
||||||
<a name="required-ports"></a>
|
|
||||||
### 2.4 Required Ports 🔌
|
|
||||||
Besides the ports generally needed by the OS, i.e. obtaining a DHCP lease, DNS, etc. T-Pot will require the following ports for incoming / outgoing connections. Review the [T-Pot Architecture](#technical-architecture) for a visual representation. Also some ports will show up as duplicates, which is fine since used in different editions.
|
|
||||||
|
|
||||||
| Port | Protocol | Direction | Description |
|
|
||||||
| :------------------------------------------------------------------------------------------------------------------------------------ | :------- | :-------- | :-------------------------------------------------------------------------------------------------- |
|
|
||||||
| 80, 443 | tcp | outgoing | T-Pot Management: Install, Updates, Logs (i.e. OS, GitHub, DockerHub, Sicherheitstacho, etc. |
|
|
||||||
| 11434 | tcp | outgoing | LLM based honeypots: Access your Ollama installation |
|
|
||||||
| 64294 | tcp | incoming | T-Pot Management: Sensor data transmission to hive (through NGINX reverse proxy) to 127.0.0.1:64305 |
|
|
||||||
| 64295 | tcp | incoming | T-Pot Management: Access to SSH |
|
|
||||||
| 64297 | tcp | incoming | T-Pot Management Access to NGINX reverse proxy |
|
|
||||||
| 5555 | tcp | incoming | Honeypot: ADBHoney |
|
|
||||||
| 22 | tcp | incoming | Honeypot: Beelzebub (LLM required) |
|
|
||||||
| 5000 | udp | incoming | Honeypot: CiscoASA |
|
|
||||||
| 8443 | tcp | incoming | Honeypot: CiscoASA |
|
|
||||||
| 443 | tcp | incoming | Honeypot: CitrixHoneypot |
|
|
||||||
| 80, 102, 502, 1025, 2404, 10001, 44818, 47808, 50100 | tcp | incoming | Honeypot: Conpot |
|
|
||||||
| 161, 623 | udp | incoming | Honeypot: Conpot |
|
|
||||||
| 22, 23 | tcp | incoming | Honeypot: Cowrie |
|
|
||||||
| 19, 53, 123, 1900 | udp | incoming | Honeypot: Ddospot |
|
|
||||||
| 11112 | tcp | incoming | Honeypot: Dicompot |
|
|
||||||
| 21, 42, 135, 443, 445, 1433, 1723, 1883, 3306, 8081 | tcp | incoming | Honeypot: Dionaea |
|
|
||||||
| 69 | udp | incoming | Honeypot: Dionaea |
|
|
||||||
| 9200 | tcp | incoming | Honeypot: Elasticpot |
|
|
||||||
| 22 | tcp | incoming | Honeypot: Endlessh |
|
|
||||||
| 80, 443, 8080, 8443 | tcp | incoming | Honeypot: Galah (LLM required) |
|
|
||||||
| 8080 | tcp | incoming | Honeypot: Go-pot |
|
|
||||||
| 80, 443 | tcp | incoming | Honeypot: H0neytr4p |
|
|
||||||
| 21, 22, 23, 25, 80, 110, 143, 443, 993, 995, 1080, 5432, 5900 | tcp | incoming | Honeypot: Heralding |
|
|
||||||
| 3000 | tcp | incoming | Honeypot: Honeyaml |
|
|
||||||
| 21, 22, 23, 25, 80, 110, 143, 389, 443, 445, 631, 1080, 1433, 1521, 3306, 3389, 5060, 5432, 5900, 6379, 6667, 8080, 9100, 9200, 11211 | tcp | incoming | Honeypot: qHoneypots |
|
|
||||||
| 53, 123, 161, 5060 | udp | incoming | Honeypot: qHoneypots |
|
|
||||||
| 631 | tcp | incoming | Honeypot: IPPHoney |
|
|
||||||
| 80, 443, 8080, 9200, 25565 | tcp | incoming | Honeypot: Log4Pot |
|
|
||||||
| 25 | tcp | incoming | Honeypot: Mailoney |
|
|
||||||
| 2575 | tcp | incoming | Honeypot: Medpot |
|
|
||||||
| 9100 | tcp | incoming | Honeypot: Miniprint |
|
|
||||||
| 6379 | tcp | incoming | Honeypot: Redishoneypot |
|
|
||||||
| 5060 | tcp/udp | incoming | Honeypot: SentryPeer |
|
|
||||||
| 80 | tcp | incoming | Honeypot: Snare (Tanner) |
|
|
||||||
| 8090 | tcp | incoming | Honeypot: Wordpot |
|
|
||||||
|
|
||||||
---
|
---
|
||||||
<a name="update-script"></a>
|
<a name="update-script"></a>
|
||||||
### Update Script 🔄
|
### Update Script 🔄
|
||||||
|
|
@ -450,14 +450,6 @@ The update script will ...
|
||||||
- update all files in `~/tpotce` to be in sync with the T-Pot master branch
|
- update all files in `~/tpotce` to be in sync with the T-Pot master branch
|
||||||
- restore your custom `ews.cfg` from `~/tpotce/data/ews/conf` and the T-Pot configuration (`~/tpotce/.env`).
|
- restore your custom `ews.cfg` from `~/tpotce/data/ews/conf` and the T-Pot configuration (`~/tpotce/.env`).
|
||||||
|
|
||||||
---
|
|
||||||
<a name="uninstall-tpot"></a>
|
|
||||||
### 2.2 Uninstall T-Pot 🧹
|
|
||||||
Uninstallation of T-Pot is only available on the [supported Linux distros](#choose-your-distro).<br>
|
|
||||||
To uninstall T-Pot run ~/tpotce/uninstall.sh and follow the uninstaller instructions, you will have to enter your password at least once.<br>
|
|
||||||
Once the uninstall is finished reboot the machine sudo reboot
|
|
||||||
<br><br>
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
<a name="data-analysis-and-insights"></a>
|
<a name="data-analysis-and-insights"></a>
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue