Awesome
HoneyPress - WordPress honeypot
WordPress honeypot in a docker container
Update:
I have began a complete re-write / re-implementation of this idea. Decided it would be best to go with good ol' Flask and python for creating a "WordPress" install. Because of Flask's flexibility and Python's modularity there are all kinds of fun to be had.
Clone and build Docker image
$ git clone https://github.com/dustyfresh/HoneyPress.git
$ cd HoneyPress && docker build --rm -t honeypress .
Start HoneyPress
$ docker run -d --name HoneyPress -p 80:80
Logs
You can view access logs easily:
$ docker exec honeypress bash -c 'tail /opt/honeypress/logs/access.log'
192.168.99.1 - - [06/Jun/2016 03:21:41] "GET /wp-login.php?__debugger__=yes&cmd=resource&f=style.css HTTP/1.1" 200 -
192.168.99.1 - - [06/Jun/2016 03:21:41] "GET /wp-login.php?__debugger__=yes&cmd=resource&f=jquery.js HTTP/1.1" 200 -
192.168.99.1 - - [06/Jun/2016 03:21:41] "GET /wp-login.php?__debugger__=yes&cmd=resource&f=debugger.js HTTP/1.1" 200 -
192.168.99.1 - - [06/Jun/2016 03:21:41] "GET /wp-login.php?__debugger__=yes&cmd=resource&f=console.png HTTP/1.1" 200 -
192.168.99.1 - - [06/Jun/2016 03:21:41] "GET /wp-login.php?__debugger__=yes&cmd=resource&f=ubuntu.ttf HTTP/1.1" 200 -
192.168.99.1 - - [06/Jun/2016 03:21:41] "GET /wp-login.php?__debugger__=yes&cmd=resource&f=console.png HTTP/1.1" 200 -
192.168.99.1 - - [06/Jun/2016 03:21:44] "GET /wp-login.php HTTP/1.1" 200 -
192.168.99.1 - - [06/Jun/2016 03:21:46] "POST /wp-login.php HTTP/1.1" 200 -
Password logging
If you wanted to extract a list of passwords used in testing:
$ docker exec honeypress bash -c 'tail /opt/honeypress/logs/auth.log'
[2016-06-06 03:21:41.061363] - 192.168.99.1 - user: admin pass: admin - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:46.0) Gecko/20100101 Firefox/
46.0
ToDo
- Log shipping (prolly will just use rsyslog / S3)
- Bake in notifications (SMS & email)
- Capture all POST/GET payload data into a log to be looked at later by an analyst.
- Figure out a way to introduce fake MySQL for SQLi analysis and payload capture
- TCP dump analysis
- Access log monitoring (look for things like sql injections, LFI/RFI, XSS, etc)
- Modular vulnerabilities. Need to make it easier to fake a new vulnerability so scanners think they're exploiting a live target
- Tor detection
- Database of some sort.. haven't decided if I should go with MongoDB or just use sqlite. Not sure about performance yet.
- Do some benchmarking.. is nginx needed?
- Some gangster-ish browser fingerprinting (that supports Tor browsers too)
- SLAP SOME GRAPHS ON THIS SHIT