v1.1.0 — 14 Protocols, Multi-Platform Reporting, Security Hardening

🚀 What's New

New Protocol Handlers

• 🗃️ MSSQL — Fake SQL Server 2019 with TDS prelogin + login handshake (port 14330)
• 📡 SNMP — Fake SNMP v1/v2c UDP agent with sysDescr, sysName, sysUptime responses (port 16100) — Closes #1
• 🌐 HTTP Proxy — Fake Squid 5.7 proxy capturing CONNECT tunnels (port 8180)

Reporting Integration

• Existing platforms (AbuseIPDB, OTX, DShield, Blocklist.de) now receive attack data from the 3 new protocols automatically

Security Hardening

• 🛡️ Anti-timing fingerprint — 150-800ms random jitter on all HTTP responses prevents attackers from detecting the honeypot via response time analysis
• 🔒 Caddy header hardening — strips Via header, keeps fake Server: Apache and X-Powered-By: PHP
• 🔒 FTP PASV IP — returns plausible public IP (203.0.113.45) instead of internal LAN
• 🔒 Report poisoning protection — uses socket IP only, never trusts X-Forwarded-For (except with proxy secret)
• 🔒 Private IP filter — never reports internal IPs to AbuseIPDB/OTX

Testing

• 119 tests passing (all offline, no Ollama required)
• Advanced pentest audit: 13 attack vectors tested (SSRF, report poisoning, path traversal, prototype pollution, SSH escape, DoS, log injection, timing fingerprint)

Full Changelog

Protocols: 11 → 14 (MSSQL, SNMP, HTTP Proxy)
Tests: 98 → 119