All Projects → Ar3h → anti-honeypot

Ar3h / anti-honeypot

Licence: other
一款可以检测WEB蜜罐并阻断请求的Chrome插件,能够识别并阻断长亭D-sensor、墨安幻阵的部分溯源api

Programming Languages

javascript
184084 projects - #8 most used programming language
HTML
75241 projects

Projects that are alternatives of or similar to anti-honeypot

Nishang
Nishang - Offensive PowerShell for red team, penetration testing and offensive security.
Stars: ✭ 5,943 (+15539.47%)
Mutual labels:  red-team, redteam
Gitlab Watchman
Monitoring GitLab for sensitive data shared publicly
Stars: ✭ 127 (+234.21%)
Mutual labels:  red-team, redteam
ReversePowerShell
Functions that can be used to gain Reverse Shells with PowerShell
Stars: ✭ 48 (+26.32%)
Mutual labels:  red-team, redteam
Sherlock
This script is designed to help expedite a web application assessment by automating some of the assessment steps (e.g., running nmap, sublist3r, metasploit, etc.)
Stars: ✭ 36 (-5.26%)
Mutual labels:  red-team, redteam
InlineWhispers2
Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2
Stars: ✭ 156 (+310.53%)
Mutual labels:  red-team, redteam
Powershell Red Team
Collection of PowerShell functions a Red Teamer may use to collect data from a machine
Stars: ✭ 155 (+307.89%)
Mutual labels:  red-team, redteam
Thecollective
The Collective. A repo for a collection of red-team projects found mostly on Github.
Stars: ✭ 85 (+123.68%)
Mutual labels:  red-team, redteam
aterm
It records your terminal, then lets you upload to ASHIRT
Stars: ✭ 17 (-55.26%)
Mutual labels:  red-team, redteam
Community Threats
The GitHub of Adversary Emulation Plans in JSON. Share SCYTHE threats with the community. #ThreatThursday adversary emulation plans are shared here.
Stars: ✭ 169 (+344.74%)
Mutual labels:  red-team, redteam
Slack Watchman
Monitoring your Slack workspaces for sensitive information
Stars: ✭ 159 (+318.42%)
Mutual labels:  red-team, redteam
github-watchman
Monitoring GitHub for sensitive data shared publicly
Stars: ✭ 60 (+57.89%)
Mutual labels:  red-team, redteam
palinka c2
Just another useless C2 occupying space in some HDD somewhere.
Stars: ✭ 14 (-63.16%)
Mutual labels:  red-team, redteam
Galaxy-Bugbounty-Checklist
Tips and Tutorials for Bug Bounty and also Penetration Tests.
Stars: ✭ 34 (-10.53%)
Mutual labels:  red-team
VindicateTool
LLMNR/NBNS/mDNS Spoofing Detection Toolkit
Stars: ✭ 40 (+5.26%)
Mutual labels:  honeypot
sherlock
🔎 Find usernames across social networks
Stars: ✭ 52 (+36.84%)
Mutual labels:  redteam
brutas
Wordlists and passwords handcrafted with ♥
Stars: ✭ 32 (-15.79%)
Mutual labels:  redteam
cowrie-logviewer
A simple log viewer for cowrie
Stars: ✭ 20 (-47.37%)
Mutual labels:  honeypot
CVE-2021-44228-PoC-log4j-bypass-words
🐱‍💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks
Stars: ✭ 760 (+1900%)
Mutual labels:  red-team
ElasticpotPY
Elasticsearch honeypot written in Python with Bottle framework
Stars: ✭ 16 (-57.89%)
Mutual labels:  honeypot
trident
automated password spraying tool
Stars: ✭ 133 (+250%)
Mutual labels:  redteam

背景

蓝方的WEB蜜罐通常带有溯源功能,原理类似CSRF。打开WEB蜜罐后,自带的js会自动遍历能够识别你的身份信息的其他网站api,例如baidu、58、163等,如果你恰好在这些网站上有已登录的cookie,就会通过这个网站的api获得你的用户名,可能还会有邮箱、电话、姓名等

插件原理

本插件所采用的原理非常简单粗暴,就是判断当前网站域和jsonp接口的域是否是同一个,是的话就预警并阻断。比如我访问一个的网站,结果这个网站里的js去请求了一个baidu.com的api,那妥妥的有问题了。

但是粗暴判断也会带来误报,比如我正常访问baidu.com,但是其引用了个apibaidu.com的jsonp,就一样也会报警和拦截,这种情况下就暂时用白名单来解决了。

具有黑名单host(来自长亭蜜罐api溯源请求)匹配功能:如果匹配到基于蜜罐溯源黑名单的host,会做另外的弹框预警,如果有多个黑名单host弹框报警,说明这个蜜罐的可能性会比较大。

其余跨主域请求拦截,需要肉眼判断一下是否合法

拦截顺序顺序:

  1. 白名单的主域不受影响
  2. 主域下的子域不受影响
  3. 基于黑名单的拦截,发出黑名单拦截报警
  4. 其余跨主域请求,发出可疑溯源报警

chrome插件使用

  1. 下载并解压源码
  2. 打开chrome的插件管理 chrome://extensions/
  3. 打开开发者模式,并点击”加载已解压的扩展程序”,选择对应的目录导入即可
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].