v0.27.0 — pghoney + nosqlpot + sticky_elephant
Adds PostgreSQL and NoSQL honeypot fingerprinting. Three new detections:
pghoney (betheroot/pghoney) — Go PostgreSQL honeypot:
- 99% — MD5 auth salt 0x336FBFD2 hardcoded in serverutils.go:67 — same bytes on every connection/restart; real PostgreSQL generates a random salt per connection
nosqlpot (torque59/nosqlpot) — Python 2 Redis+CouchDB honeypot:
- 99% Redis —
AUTHreturns-ERR unknown command 'auth'(lowercase single-quote; distinguishes from RedisHoneyPot's backtick-uppercase format and real Redis -NOAUTH/-WRONGPASS) - 99% Redis — INFO returns static
process_id=30064(never changes) - 99% CouchDB — welcome JSON body has trailing semicolon (invalid JSON)
- 95% CouchDB —
Content-Type: charset=utf-7(real CouchDB always uses utf-8)
sticky_elephant (betheroot/sticky_elephant) — Ruby PostgreSQL honeypot:
- 90% — cleartext auth (type 3) + AuthOk for any submitted password (authenticate() unconditional)
- 99% — BackendKeyData
pid=666hardcoded in postgres_simulator.rb (real PostgreSQL sends actual OS PID)
Port 5432 fast-path added for pghoney/sticky_elephant. Nosqlpot Redis probes wired into the 6379/6380 dispatch.