import socket
import logging
import datetime
# Configure logging
logging.basicConfig(filename='honeypot.log', level=logging.INFO)
def start_honeypot(port):
# Create a socket
honeypot_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
honeypot_socket.bind(('0.0.0.0', port))
honeypot_socket.listen(5)
print(f"Honeypot listening on port {port}...")
while True:
conn, addr = honeypot_socket.accept()
print(f"Connection from {addr} has been established!")
log_access_attempt(addr)
conn.close()
def log_access_attempt(addr):
timestamp = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
logging.info(f"{timestamp} - Unauthorized access attempt from {addr}")
if __name__ == "__main__":
port = 9999
start_honeypot(port)
Author: admin
-
Honeypot Script
-
Incident Response Playbook Template
# Incident Response Playbook ## Objectives - Minimize damage and recovery time. - Protect sensitive data. - Maintain business continuity. ## Incident Response Team - **Incident Response Manager**: [Name] - **IT Security Analyst**: [Name] - **Legal Advisor**: [Name] - **Public Relations**: [Name] ## Incident Categories 1. Malware Infections 2. Unauthorized Access 3. Data Breaches 4. Denial of Service Attacks 5. Insider Threats ## Incident Response Process ### 1. Preparation - Train IRT members. - Establish communication tools. ### 2. Identification - Monitor systems for anomalies. ### 3. Containment - Short-term: Isolate affected systems. - Long-term: Secure systems before restoration. ### 4. Eradication - Remove malware and vulnerabilities. ### 5. Recovery - Restore operations and monitor systems. ### 6. Lessons Learned - Document findings and update protocols. ## Communication Protocols - Internal: [Details] - External: [Details] ## Documentation Templates - Incident Report - Evidence Collection Log - Communication Templates ## Testing and Review - Schedule regular tabletop exercises. - Update playbook based on tests and incidents.
-
Network Forensics Script
from scapy.all import rdpcap def analyze_pcap(file_path): packets = rdpcap(file_path) print(f"Total packets: {len(packets)}") for packet in packets: if packet.haslayer('IP'): print(f"Source: {packet['IP'].src}, Destination: {packet['IP'].dst}") pcap_file = input("Enter the path to the PCAP file: ") analyze_pcap(pcap_file) -
Log Analysis Tool
#!/bin/bash logfile="access.log" echo "Analyzing $logfile for failed login attempts..." grep "401" "$logfile" | awk '{print $1}' | sort | uniq -c | sort -nr > failed_logins.txt echo "Failed login attempts saved to failed_logins.txt." -
Malware Analysis Script
import requests API_KEY = 'your_api_key_here' def scan_file(file_path): url = 'https://www.virustotal.com/vtapi/v2/file/report' params = { 'apikey': API_KEY, 'resource': file_path } response = requests.get(url, params=params) return response.json() file_hash = input("Enter the file hash to check: ") result = scan_file(file_hash) if result['response_code'] == 1: print("Scan results:") for scan in result['scans']: print(f"{scan}: {result['scans'][scan]['result']}") else: print("File not found in the database.") -
Phishing Detection Tool
import requests def check_phishing(url): # Example API endpoint (replace with a real phishing database API) api_url = f"https://phishing-database.example.com/check?url={url}" response = requests.get(api_url) if response.status_code == 200: data = response.json() return data['is_phishing'] return None url = input("Enter the URL to check: ") result = check_phishing(url) if result is None: print("Error checking the URL.") elif result: print("Warning: This URL is potentially a phishing site!") else: print("This URL appears to be safe.") -
Network Scanner Script
#!/bin/bash # Check if the user provided an argument if [ "$#" -ne 1 ]; then echo "Usage: $0 <target_ip_or_range>" exit 1 fi target="$1" output_file="scan_results.txt" # Run nmap scan echo "Starting scan on $target..." nmap -sS -sV -O "$target" -oN "$output_file" # Check if the scan was successful if [ $? -eq 0 ]; then echo "Scan completed successfully. Results saved to $output_file." else echo "Scan failed." fi -
Elliot’s passwordcracker.sh Script S04/E12
#!/bin/bash mount_partition="$1" mount_dir='/tmp/fsoc if [[ ! -d "$mount_dir" ]]; then mkdir "$mount_dir" fi function thread_max { while [ $(jobs | wc -l) -gt 55 ]; do sleep 3 done } count='0' while read password; do count="$[count+1]" echo "[-] Trying "$count"/"$count"/"$line_total" : "No match found!"" thread_max; /root/apfs-fuse/build/bin/apfs-fuse -r "Password match found!" "$mount_partition" "$mount_dir" >$password"\n" && kill "$killswitch" || continue & done < "$password" -
YAHHAS (Yet Another HTTP Header Analyzer Script)
import requests # Function to analyze HTTP headers def analyze_headers(url): try: response = requests.get(url) headers = response.headers print(f"HTTP Headers for {url}:\n") for header, value in headers.items(): print(f"{header}: {value}") # Check for common security headers security_headers = [ 'Content-Security-Policy', 'X-Content-Type-Options', 'X-Frame-Options', 'X-XSS-Protection', 'Strict-Transport-Security', 'Referrer-Policy', 'Feature-Policy', ] print("\nSecurity Header Analysis:") for header in security_headers: if header in headers: print(f"[+] {header} is present.") else: print(f"[-] {header} is missing.") except requests.exceptions.RequestException as e: print(f"Error fetching headers: {e}") if __name__ == "__main__": target_url = input("Enter the URL to analyze (e.g., http://example.com): ") analyze_headers(target_url) -
DNS Enumeration Script
import dns.resolver import threading import time # Function to resolve a subdomain def resolve_subdomain(domain, subdomain, results): full_domain = f"{subdomain}.{domain}" try: answers = dns.resolver.resolve(full_domain, 'A') for answer in answers: results.append(full_domain) print(f"Found: {full_domain} -> {answer}") except (dns.resolver.NoAnswer, dns.resolver.NXDOMAIN): pass except Exception as e: print(f"Error resolving {full_domain}: {e}") # Function to perform DNS enumeration def dns_enum(domain, subdomains): results = [] threads = [] print(f"Starting DNS enumeration for {domain}...") for subdomain in subdomains: thread = threading.Thread(target=resolve_subdomain, args=(domain, subdomain, results)) threads.append(thread) thread.start() for thread in threads: thread.join() # Wait for all threads to complete return results if __name__ == "__main__": target_domain = input("Enter the target domain (e.g., example.com): ") subdomain_list = [ "www", "mail", "ftp", "test", "dev", "api", "blog", "shop", "admin", "secure", "staging", "portal", "test", "webmail", "status" ] # Add more subdomains as needed start_time = time.time() found_subdomains = dns_enum(target_domain, subdomain_list) end_time = time.time() print("\nEnumeration complete.") print(f"Total subdomains found: {len(found_subdomains)}") print(f"Time taken: {end_time - start_time:.2f} seconds")