No description, website, or topics provided.
Ruby JavaScript CSS CoffeeScript
Latest commit 712d607 Sep 25, 2014 @ahoernecke Fixed typo
Permalink
Failed to load latest commit information.
app fixed configs Apr 5, 2014
config initial commit Apr 5, 2014
db/migrate initial commit Apr 5, 2014
lib Updated templated ensnare.rb Apr 5, 2014
script initial commit Apr 5, 2014
test Update to layout files Apr 5, 2014
.DS_Store initial commit Apr 5, 2014
.gitignore initial commit Apr 5, 2014
CHANGELOG Added metadata Apr 5, 2014
Gemfile initial commit Apr 5, 2014
Gemfile.lock Added metadata Apr 5, 2014
LICENSE initial commit Apr 5, 2014
README.md Fixed typo Sep 25, 2014
Rakefile initial commit Apr 5, 2014
ensnare.gemspec initial commit Apr 5, 2014
ensnare.gemspec.save initial commit Apr 5, 2014

README.md

Ensnare

Ensnare is packaged as a gem plugin for Ruby on Rails and was developed to allow configuring and deploying a basic malicious behavior detection and response scheme in less than ten minutes.

Ensnare uses a combination of Honey Traps to entice malicious users, and a configurable suite of Trap Responses to confuse, allude, delay, or stop an attacker.

Already heard about the tool and want to try it out? Do it!

#Install#

Add the gem to your project's Gemfile:

    gem 'ensnare', :git => 'git@github.com:ahoernecke/Ensnare.git'

Install the gem:

    bundle install

Run the migrations for Ensnare:

    rake ensnare:install:migrations
    rake db:migrate

Enable parameter tampering for your application by changing the mass_assignment_sanitizer:

    vi config/environments/<ENVIRONMENT>.rb

Set config.active_record.mass_assignment_sanitizer to logger:

    config.active_record.mass_assignment_sanitizer = :logger 

Enable Ensnare in your application_controller.rb file:

    vi app/controllers/application_controller.rb

Append the following filter below protect_from_forgery in your application_controller.rb file:

    before_filter :ensnare

Add the following to the end of your routes.rb file:

    mount Ensnare::Engine => "/ensnare", :as => "ensnare_engine" 
    match "*_", :to => "ensnare::violations#routing_error"

Create an Ensnare config file:

    rails g ensnare:install

Take a look at the example ensnare.rb file:

    vi config/initializes/ensnare.rb

After you start your application, take a look at the dashboard:

http://your-application.com/ensnare/dashboard/violations

In order to access the dashboard, this step needs to be performed.

To prevent unnecessary users from accessing the dashboard, add the following to the config/initalizers/ensnare.rb file:

  config.dashboard_user_method = :current_user
  config.dashboard_authorization_method = :admin?

NOTE: you need to have a method defined to check if the user is the admin.

#Documentation#

Wiki

#Bugs#

Dashboard CSS Issues in Firefox

#Resources#

http://books.google.com/books?id=flC9dFFLWIsC&pg=PT111&lpg=PT111&dq=honey+trap+mod+security&source=bl&ots=zKxJvehMpA&sig=E9qKn7L4siEk01caEF6wqofbbm8&hl=en&sa=X&ei=_iRUUoCRJKPiiwK8y4HIBA&ved=0CFUQ6AEwBg#v=onepage&q=honey trap mod security&f=false

##Contact## Created by Andy Hoernecke and Scott Behrens.

Feel free to reach out to us if you have questions or want to contribute to the project!