Skip to content
Flamingo captures credentials sprayed across the network by various IT and security products.
Go Other
  1. Go 99.8%
  2. Other 0.2%
Branch: master
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
cmd
pkg report url, fixes #8. update off-by-one, fixes #9 Feb 5, 2020
.gitignore ignore dist Jan 25, 2020
.goreleaser.yml fix 386 build target Jan 26, 2020
Dockerfile Adding Dockerfile Jan 27, 2020
LICENSE its a bird Jan 19, 2020
README.md update README with credits/grammar Jan 27, 2020
go.mod go.mod/go.sum updates Jan 27, 2020
go.sum go.mod/go.sum updates Jan 27, 2020
main.go its a bird Jan 19, 2020

README.md

Flamingo

A filter-feeding bird. Captures credentials sprayed across the network by various IT and security products.

Currently supports SSH, HTTP, LDAP, DNS, FTP, and SNMP credential collection.

Pull requests are encouraged for additional protocols and output destinations.

Usage

  1. Obtain the flamingo binary from the releases page or build from source.
$ GOOS=win32 GOARCH=amd64 go build -o flamingo.exe
$ go get -u -v github.com/atredispartners/flamingo && \
  go install -v github.com/atredispartners/flamingo && \
  $GOPATH/bin/flamingo
  1. Run the binary and collect credentials
C:\> flamingo.exe

{"_etime":"2020-01-10T17:56:51Z","_host":"1.2.3.4:18301","_proto":"ssh","method":"pubkey","pubkey":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPVSxqrWfNle0nnJrKS3NA12uhu9PHxnP4OlD843tRz/","pubkey-sha256":"SHA256:/7UkXjk0XtBe9N6RrAGGgJTGuKKi1Hgk3E+4TPo54Cw","username":"devuser","version":"SSH-2.0-OpenSSH_for_Windows_7.7"}

{"_etime":"2020-01-10T17:56:52Z","_host":"1.2.3.4:1361","_proto":"ssh","method":"password","password":"SuperS3kr3t^!","username":"root","version":"SSH-2.0-OpenSSH_for_Windows_7.7"}

{"_etime":"2020-01-10T17:56:53Z","_host":"1.2.3.4:9992","_proto":"ssh","method":"password","password":"DefaultPotato","username":"vulnscan-a","version":"SSH-2.0-OpenSSH_for_Windows_7.7"}

The default is to log credentials to standard output and append to flamingo.log in the working directory.

Options

Use --protocols to configure a list of enabled protocol listeners

Use additional options to specify ports and protocol options for listeners.

All additional command-line arguments are output destinations.

Outputs

Flamingo can write recorded credentials to a variety of output formats. By default, flamingo will log to flamingo.log and standard output.

Standard Output

Specifying - or stdout will result in flamingo only logging to standard output.

File Destinations

Specifying one or more file paths will result in flamingo appending to these files.

HTTP Destinations

Specifying HTTP or HTTPS URLs will result in flamingo sending a webhook POST request to each endpoint.

By default, this format supports platforms like Slack and Mattermost that support inbound webhooks.

The actual HTTP POST looks like:

POST /specified-url
Content-Type: application/json
User-Agent: flamingo/v0.0.0

{"text": "full-json-output of credential report"}

Syslog Destinations

Specifying syslog or syslog:<parameters> will result in flamingo sending credentials to a syslog server.

The following formats are supported:

  • syslog - send to the default syslog output, typically a unix socket
  • syslog:unix:/dev/log - send to a specific unix stream socket
  • syslog:host - send to the specified host using udp and port 514
  • syslog:host:port - send to the specified host using udp and the specified port
  • syslog:udp:host - send to the specified host using udp and port 514
  • syslog:udp:host:port - send to the specified host using udp and the specified port
  • syslog:tcp:host - send to the specified host using tcp and port 514
  • syslog:tcp:host:port - send to the specified host using tcp and the specified port
  • syslog:tcp+tls:host - send to the specified host using tls over tcp and port 514
  • syslog:tcp+tls:host:port - send to the specified host using tls over tcp and the specified port

Credits

You can’t perform that action at this time.