diff --git a/README.md b/README.md index 83774f19..156aae31 100644 --- a/README.md +++ b/README.md @@ -311,55 +311,82 @@ These errors are not critical and T-Pot should still function correctly. ### 2.3 Testing ConPot 🦠 -In this section, we will perform tests on the **[Conpot](http://conpot.org/)** honeypot, as mentioned in section [1.3.1 Industrial and Medical Honeypots 🏭](#industrial-and-medical-honeypots). - -1. **[Conpot](http://conpot.org/)**: Simulates Industrial Control Systems (ICS) and protocols like Modbus, SNMP, and S7comm. +In this section, we will perform tests on the **[Conpot](http://conpot.org/)** honeypot, as mentioned in section [1.3.1 Industrial and Medical Honeypots 🏭](#industrial-and-medical-honeypots) **[Conpot](http://conpot.org/)** simulates Industrial Control Systems (ICS) and protocols like Modbus (port 502), SNMP (port 161), and S7comm (port 102). **Verify if Conpot exposes the expected services (e.g., port 80 for HTTP, port 502 for Modbus, port 161 for SNMP):** - ```sh nmap -sV -p 1-65535 -nmap -sS -p- 127.0.0.1 # TCP SYN scan (all ports) -nmap -sU -p- 127.0.0.1 # UDP scan (all ports) -nmap -sV 127.0.0.1 # Service version detection +nmap -sS -p- # TCP SYN scan (all ports) +nmap -sU -p- # UDP scan (all ports) +nmap -sV # Service version detection ``` +**2.4 Testing (ModBusSploit) 🛠️** + +In this section, we will perform tests on the **[ModBusSploit](https://github.com/C4l1b4n/ModBusSploit/)** tool to simulate attacks on the Conpot honeypot. + +**Step 1: Clone the ModBusSploit repository:** +```sh +git clone https://github.com/C4l1b4n/ModBusSploit/ +cd ModBusSploit +``` + +**Step 2: Install the required dependencies:** +```sh +pip install -r requirements.txt +``` + +**Step 3: Run the script +```sh +python3 start.py +``` + +**Screenshots:** + +1. **Start Dos Attack:** +modbus + +2. **Result on conpot log:** +![conpot_log](https://github.com/user-attachments/assets/e33cb1ab-e89c-4314-b395-9e63147b54b8) + +3. **Result on Kibana dashboard:** +kibana_dash + + + **Brute force attack examples using Hydra:** - ```sh -hydra -l -P ssh://127.0.0.1 -hydra -l -P ftp://127.0.0.1 -hydra -l -P http-get://127.0.0.1 +hydra -l -P ssh:// +hydra -l -P ftp:// +hydra -l -P http-get:// ``` -**Exploitation example using Metasploit:** + +**Exploitation example using Metasploit:** ```sh msfconsole use exploit/linux/ssh/sshexec -set RHOST 127.0.0.1 +set RHOST set USERNAME set PASSWORD exploit ``` **Example of an XSS attack using curl:** - ```sh -curl -X POST -d "username=" http://127.0.0.1/login +curl -X POST -d "username=" http:///login ``` **SQL injection example using sqlmap:** - ```sh -sqlmap -u "http://127.0.0.1/page?id=1" --risk=3 --level=5 +sqlmap -u "http:///page?id=1" --risk=3 --level=5 ``` **Netcat example to connect to port 80 (HTTP):** - ```sh -nc -v 127.0.0.1 80 +nc -v 80 ``` ---