yunginnanet/hellpot

HellPot is a portal to endless suffering meant to punish unruly HTTP bots.

HellPot

Summary

HellPot is an endless honeypot based on Heffalump that sends unruly HTTP bots to hell.

Notably it implements a toml configuration file, has JSON logging, and comes with significant performance gains.

Grave Consequences

Clients (hopefully bots) that disregard robots.txt and connect to your instance of HellPot will suffer eternal consequences.

HellPot will send an infinite stream of data that is just close enough to being a real website that they might just stick around until their soul is ripped apart and they cease to exist.

Under the hood of this eternal suffering is a markov engine that chucks bits and pieces of The Birth of Tragedy (Hellenism and Pessimism) by Friedrich Nietzsche at the client using fasthttp.

Building From Source

HellPot should probably be built with Go version 1.17 or higher.

HellPot uses go modules. This should make it dead simple to build with a stock Go installation. To make it even simpler, we've added a GNU Makefile.

1 ) git clone https://github.com/yunginnanet/HellPot

2 ) cd HellPot

4 ) make

5 ) Consider the potential grave consequences of your actions.

Usage

YOLO Method:

In the event of a missing configuration file, HellPot will attempt to place it's default config in $HOME/.config/HellPot/config.toml. This allows irresponsible souls to begin raining hellfire with ease, immediately:

1 ) Download a compiled release

2 ) Run binary and immedidately begin sending clients directly to hell.

---

Reasonable Method:

1 ) Configure webserver as reverse proxy (see below)

2 ) ./HellPot --genconfig

3 ) Edit your newly generated config.toml as desired.

4 ) Ponder your existence server's ability to handle your chosen performance values.

5 ) ./HellPot -c config.toml

666 ) 𝙏͘͝𝙝̓̓͛𝙚͑̈́̀ 𝙨͆͠͝𝙠͑̾͌𝙮̽͌͆ 𝙞̓̔̔𝙨͒͐͝ 𝙛͑̈́̚𝙖͛͒𝙡͑͆̽𝙡̾̚̚𝙞͋̒̒𝙣̾͛͝𝙜͒̒̀.́̔͝​

Configuration Reference

[deception]
  # Used as "Server" HTTP header. Note that reverse proxies may hide this.
  server_name = "nginx"

[http]
  # TCP Listener (default)
  bind_addr = "127.0.0.1"
  bind_port = "8080"

  # header name containing clients real IP, for reverse proxy deployments
  real_ip_header = 'X-Real-IP'

  # this contains a list of blacklisted useragent strings. (case sensitive)
  # clients with useragents containing any of these strings will receive "Not found" for any requests.
  uagent_string_blacklist = ["Cloudflare-Traffic-Manager", "curl"]

  # Unix Socket Listener (will override default)
  unix_socket_path = "/var/run/hellpot"
  unix_socket_permissions = "0666"
  use_unix_socket = false

  [http.router]
    # Toggling this to true will cause all GET requests to match. Forces makerobots = false.
    catchall = false
    # Toggling this to false will prevent creation of robots.txt handler.
    makerobots = true
    # Handlers will be created for these paths, as well as robots.txt entries. Only valid if catchall = false.
    paths = ["wp-login.php", "wp-login"]

[logger]
  # verbose (-v)
  debug = true
  # extra verbose (-vv)
  trace = false
  # JSON log files will be stored in the below directory.
  directory = "/home/kayos/.local/share/HellPot/logs/"
  # disable all color in console output. when using Windows this will default to true.
  nocolor = false
  # toggles the use of the current date as the names for new log files.
  use_date_filename = true

[performance]
  # max_workers is only valid if restrict_concurrency is true
  max_workers = 256
  restrict_concurrency = false

Example Web Server Config (nginx)

location '/robots.txt' {
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_pass http://127.0.0.1:8080$request_uri;
}

location '/wp-login.php' {
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_pass http://127.0.0.1:8080$request_uri;
}

Example Web Server Config (apache)

All nonexisting URLs are being reverse proxied to a HellPot instance on localhost, which is set to catchall. Traffic served by HellPot is rate limited to 5 KiB/s.

• Create your normal robots.txt and usual content. Also create the fake Errordocument directory and files (files can be empty). In the example, the directory is "/content/"
• A request on a URL with an existing handler (f.e. a file) will be handled by apache
• Requests on nonexisting URLs cause a HTTP Error 404, which content is served by HellPot
• URLs under the "/.well-known/" suffix are excluded.

<VirtualHost yourserver>
    ErrorDocument 400 "/content/400"
    ErrorDocument 403 "/content/403"
    ErrorDocument 404 "/content/404"
    ErrorDocument 500 "/content/405"
    <Directory "$wwwroot/.well-known/">
        ErrorDocument 400 default
        ErrorDocument 403 default
        ErrorDocument 404 default
        ErrorDocument 500 default
    </Directory>
    /* HTTP Honeypot / HellPot (need mod_proxy, mod_proxy_http) */
    ProxyPreserveHost	on
    ProxyPass         "/content/" "http://localhost:8080/"
    ProxyPassReverse  "/content/" "http://localhost:8080/"

    /* Rate Limit config, need mod_ratelimit */
    <Location "/content/">
        SetOutputFilter RATE_LIMIT
        SetEnv rate-limit 5
    </Location>

    /* Remaining config */

</VirtualHost>

Related Suffering

• https://github.com/ginger51011/pandoras_pot
  • A HellPot inspired HTTP honeypot to punish and educate unruly web crawlers, written in Rust (🚀)

hellpot's Issues

同学，您这个项目引入了208个开源组件，存在1个漏洞，辛苦升级一下

检测到 yunginnanet/HellPot 一共引入了208个开源组件，存在1个漏洞

漏洞标题：Go SSH拒绝服务漏洞
漏洞编号：CVE-2020-9283
漏洞描述：Go SSH是一个使用go语言开发的极度简洁的ssh工具，用于远程管理linux、unix等机器。
Go SSH存在拒绝服务漏洞，该漏洞源于网络系统或产品未对输入的数据进行正确的验证，攻击者可利用该漏洞导致拒绝服务条件，拒绝向合法用户提供服务。
国家漏洞库信息：https://www.cnvd.org.cn/flaw/show/CNVD-2020-14300
影响范围：(∞, 0.0.0-20200220183623-bac4c82f6975)
最小修复版本：0.0.0-20200220183623-bac4c82f6975
缺陷组件引入路径：github.com/yunginnanet/HellPot@->github.com/spf13/[email protected]>github.com/spf13/[email protected]>golang.org/x/[email protected]

另外还有几个漏洞，详细报告：https://mofeisec.com/jr?p=nbd6a6

Error writing new config

OS: Ubuntu Server 20.04 LTS

root@box:~# ./HellPot-0.3-linux-amd64 
error writing new config: mkdir /root/.config/HellPot: no such file or directory
open /root/.config/HellPot/config.toml: no such file or directory

fix:
mkdir -p /root/.config/HellPot

Tested:
HellPot-0.3-linux-386
HellPot-0.3-linux-amd64

[Featurerequest] - Docker

create a dockerfile and upload it to dockerhub :)

Print bytes sent in human readable format

As seen here the logger that logs to terminal returns the exact amount of bytes, which is well and good for JSON processing by other programs, but this is not ideal for human readers quickly checking the rough amount of data being sent.

My recommended solution is to automatically format bytes sent in a human readable manor but only when sent to terminal, but keep current style with JSON logging.

Add JSON response

I'm thinking of using this hellpot to reply to bots who scrape a JSON-based API, by replying to them with the ever-evolving response that never ends.

However, this hellpot replies with text, and some iterative parsers will fail and disconnect immediately upon the first character.

Is there a way for the hellpot to detect when it sends Accept: application/json and the likes, and reply with hellish JSON instead?

Consider removing "fork status" from this repository

There are considerable changes to this repository, as well as a name change.
Also, the heffalump repository seems to be inactive anyway.
Therefore, perhaps the fork status should be removed, especially since hellalump is mentioned in the README anyway.

Logging: certain fasthttp errors are not using our logger.

Behavior: 2021/10/23 02:47:15 error when serving connection "[redacted]:[redacted]"<->"[redacted]:[redacted]": error when reading request headers: cannot find http request method

Expected: 2:47AM ERR REMOTE_ADDR=[redacted]:[redacted] error when reading request headers: cannot find http request method (roughy)

This means certain fasthttp errors won't be in our JSON log as well. I'll address this soon.

Bug: CLI help menu is broken

Help doesn't show up, and also if you call -c without a config file following it, HellPot panics.

v0.4: investigate potential automatic builds via CD

I've done this with gitlab but never before with github. It would be nice for the master branch to do automatic builds upon successful pushes to master.

Ability to block wildcard user agents.

I know this is very obscure but cloudflare keeps trying to "cache" the site which immediately clashes with hellpot (even with robots.txt) so i was wondering if you could add a feature where it ignores certain user agents?

Logging, hellpot ignores logpath + creates .config folder

Just noticed that by supplying ...

..
..
log_directory = "/var/log/hellpot/"
..
..

for config.toml... outside a user's home directory is ignored and hellpot tries to setup the folder inside the user's home directory.

A quick check to test everything else is fine (i.e. permissions) I hardcoded the path in logger.go by setting logDir = "<desired path>" which is working fine.

Also I noticed, even if config.toml is present hellpot tries to create a .config/HellPot folder in the user's home directory.

code for cli help is a dumpster fire

more details here: #131 (comment)

Some URLs are not picked up by HellPot

I'm not sure if this is my fault or not, but I appreciate the feedback.

I've set up HellPot to respond to ALL requests. See the config below. Despite this config and the setup in nginx (also below) some URLs still return 404 Not Found. I am not sure why

Please note that the "error.crt" in my nginx config is a simple self-signed certificate that already blocks some malicious clients.

nginx config

server {
    listen      80 default_server;
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name _;
    location / {
        limit_rate 5k;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://127.0.0.1:8081$request_uri;
    }
    ssl_certificate     /etc/openresty/tls/error.crt;
    ssl_certificate_key /etc/openresty/tls/error.key;
}

hellpot config

[deception]
server_name = 'nginx'

[http]
bind_addr = '127.0.0.1'
bind_port = '8081'
real_ip_header = 'X-Real-IP'
uagent_string_blacklist = ['Cloudflare-Traffic-Manager']
unix_socket_path = '/var/run/hellpot'
unix_socket_permissions = '0666'
use_unix_socket = false

[http.router]
catchall = true
makerobots = true
paths = ['wp-login.php', 'wp-login']

[logger]
debug = true
directory = '/home/sander/.local/share/HellPot/logs'
nocolor = false
trace = false
use_date_filename = true

[performance]
max_workers = 256
restrict_concurrency = false

Notable URLs that return a 404 instead of HellPot:

• /_profiler/phpinfo
• .git/config
• /actuator/gateway/routes

The special character (_, .) is a hint but I'm not sure if this is something in HellPot or my nginx (config).

go 1.16.6 net/http breaks HellPot

go1.16.6 and higher breaks HellPot with its changes to net/http

HellPot takes its buffer and begins writing it straight to the http ResponseWriter, but now that ResponseWriter asserts reading the length of the source before it will write the header to our client.

breaking commit: golang/go@cb4cd9e

I am working on rewriting HellPot to use a custom HTTP server that uses raw net.Conn handling, if anyone has a better solution let me know.

Add ability to use wildcards

I wish to effectively respond to all requests (apart from robots.txt) with HellPot as to punish rouge exploit searching botnets. Such a feature would be greatly appreciated.

Ability to limit/throttle bandwidth

An option to limit bandwidth usage per second or per day/month would be a welcome feature.

HellPot desperately needs test cases

I am absolutely thrilled to see the participation rising on this repo, but it really starts to bring something to light about HellPot:

there are no test cases

the solution is simple¹: write tests

Footnotes

1. half joking here; since this is an app vs a lib, proper test coverage tends to be slightly more of a challenge ↩