Skip to content

SuckerPot v0.2.0

Choose a tag to compare

View all tags
@Theroxat Theroxat released this 26 Oct 04:36
· 409 commits to main since this release
v0.2.0
a853a89

Added

  • Seven more sensors (M9): Redis, Docker Engine API, MySQL, Microsoft SQL Server, Android ADB, SMB and SIP (UDP and TCP), each with real-client tests, per-IP fairness for CPU, memory and events, and a security review. SIP never sends a reply larger than its request.

  • Provider keys in Settings (M11): AbuseIPDB, GreyNoise and MaxMind keys stored encrypted (AES-256-GCM), write-only in the UI, with re-authentication and a "Test key" button.

  • CVE watch (M12): daily CISA KEV, NVD and GitHub advisory feeds ranked by relevance to the emulated services, with "seen in our traffic" counts and a trap-proposal sheet.

  • Indicators and threat intelligence (M13): URLs, domains, IPs and hashes extracted from events, enriched by URLhaus, ThreatFox and VirusTotal, shown on an Infrastructure page with CSV and STIX export. Passive only.

  • Users and roles (M14): admin and read-only viewer accounts, one-time temporary passwords, per-source lockout and an audit log. The .env owner account stays the root of trust.

  • Campaigns and MITRE ATT&CK (M15): sessions that share a script, payload host, hash, malware family, exploit or credential list are grouped into campaigns, with a Techniques heatmap. Off by default (CAMPAIGNS_ENABLED, ATTACK_ENABLED).

  • Defend (M16): scored blocklists, overrides, exports for OPNsense and pfSense aliases, an opt-in token feed (FEEDS_ENABLED), Sigma and Suricata rules marked "review before deploying", and "Your exposure".

  • Script library (M17): command scripts with plain-English explanations, and an optional LLM explainer (LLM_ENABLED, off by default) that sees only normalised script text.

  • Alerts and reports (M18): Discord, Microsoft Teams and e-mail (TLS) channels, alert rules that are off until switched on, a test message button, and a weekly report with a printable view. Off by default (ALERTS_ENABLED, REPORTS_ENABLED).

  • Today, search and research scanners (M19): a Today home page, a global search box, a glossary, and known research scanners labelled benign by network ownership.

  • Migrations 0011 to 0015 add the campaign, ATT&CK, Defend, script, alert and search tables and columns.

  • RDP sensor (M10): the NTLM challenge flow, so nmap --script rdp-ntlm-info returns the full Windows Server 2022 identity and logins arrive as rdp-ntlm events with the user name and domain.

  • RDP decoy accounts (RDP_ACCOUNTS): a login with a decoy password is verified against the NTLM response and tagged weak-credentials. Nothing else is ever checked.

  • Optional NLA-off mode (RDP_NLA_MODE=optional, off by default): records the cleartext user name and password from clients that skip NLA (rdp-nla-off events), tagged rdp-cleartext.

  • RDP client tool identification (nmap, FreeRDP, rdesktop, ncrack, mstsc), stored on sessions as client_tool and shown on the session page.

  • Tag bluekeep for RDP sessions that bind the MS_T120 channel.

  • RDP limit RDP_MAX_TLS_PER_IP (default 4), so a few addresses cannot hold every TLS slot.

Changed

  • Migration 0007 adds the nullable sessions.client_tool column.
  • Live page: the 3D globe is replaced by a flat world map (Equal Earth) with per-country arcs for the last 15 minutes, a stats strip, a ticker of the newest events and rankings of addresses, countries and networks. SITE_HOME_LAT, SITE_HOME_LON, SITE_HOME_LABEL and GET /api/v1/settings/site are unchanged.

Upgrade: git pull --ff-only && docker compose up -d --build — migrations 0006 to 0015 run automatically. New features are switched on with the *_ENABLED variables in .env (see docs/configuration.md); the public blocklist feed and the AI script explainer stay off by default.

🤖 Generated with Claude Code

Assets 2
Loading