Skip to content

v0.27.0 — pghoney + nosqlpot + sticky_elephant

Choose a tag to compare

@sshpie sshpie released this 26 Aug 00:29
· 9 commits to main since this release

Adds PostgreSQL and NoSQL honeypot fingerprinting. Three new detections:

pghoney (betheroot/pghoney) — Go PostgreSQL honeypot:

  • 99% — MD5 auth salt 0x336FBFD2 hardcoded in serverutils.go:67 — same bytes on every connection/restart; real PostgreSQL generates a random salt per connection

nosqlpot (torque59/nosqlpot) — Python 2 Redis+CouchDB honeypot:

  • 99% Redis — AUTH returns -ERR unknown command 'auth' (lowercase single-quote; distinguishes from RedisHoneyPot's backtick-uppercase format and real Redis -NOAUTH/-WRONGPASS)
  • 99% Redis — INFO returns static process_id=30064 (never changes)
  • 99% CouchDB — welcome JSON body has trailing semicolon (invalid JSON)
  • 95% CouchDB — Content-Type: charset=utf-7 (real CouchDB always uses utf-8)

sticky_elephant (betheroot/sticky_elephant) — Ruby PostgreSQL honeypot:

  • 90% — cleartext auth (type 3) + AuthOk for any submitted password (authenticate() unconditional)
  • 99% — BackendKeyData pid=666 hardcoded in postgres_simulator.rb (real PostgreSQL sends actual OS PID)

Port 5432 fast-path added for pghoney/sticky_elephant. Nosqlpot Redis probes wired into the 6379/6380 dispatch.