{"repo":"m-mizutani/lurker","free":true,"listed":false,"github":"https://github.com/m-mizutani/lurker","clone":"git clone https://github.com/m-mizutani/lurker.git","description":"Scalable security network sensor as low interaction honeypot","language":"Go","stars":17,"topics":["security","honeypot","packets","monitoring","go"],"license":"Apache-2.0","category":"analytics","readme_excerpt":"Lurker =============== lurker is network based honeypot for capturing payload for all TCP ports. lurker sends spoofing TCP SYN-ACK packet against attacker and scanner's TCP SYN packet. Then they will send TCP data payload after 3-way handshake and lurker captures the data and notify and save it for security research. A lot of existing honeypot has each capture mechanism for specific protocol. lurker does not have such mechanism. However lurker can capture data to all TCP ports because it just simply replies a TCP ACK packet. lurker should monitor unpublished IP address or network that are not expected to reach normal TCP connection, e.g. not associated to any domain name and services. However attackers are scanning IP address that has open TCP port everyday and finds unpublished IP address. lurker is just waiting a TCP packet from attacker silently. Below is an example of captured bad TCP payload to port 8545 from an attacker. It seems like an exploit with CVE-2016-6277. Features -------- - Reply spoofing TCP SYN-ACK packet to get the attacker to send TCP payload - Can monitor network(s) e.g. CIDR block with one host and one process by ARP spoofing - Send captured data to Slack for preview and to BigQuery for analytics Setup -------- Install with go command Use docker image Usage --------- NOTE: Root privilege OR permissions of read/write to network device are required to capture and spoof raw packet. In general, use sudo command for lurker . Monitoring traffic to IP address ","default_branch":null,"files":null,"tree":[],"storefront":"/r/m-mizutani","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/m-mizutani/lurker/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}