anti
e42fcab760
Tier 1 (upstream images): telnet (cowrie), smtp (mailoney), elasticsearch (elasticpot), conpot (Modbus/S7/SNMP ICS). Tier 2 (custom asyncio honeypots): pop3, imap, mysql, mssql, redis, mongodb, postgres, ldap, vnc, docker_api, k8s, sip, mqtt, llmnr, snmp, tftp — each with Dockerfile, entrypoint, and protocol-accurate handshake/credential capture. Adds 256 pytest cases covering registration, compose fragments, LOG_TARGET propagation, and Dockerfile presence for all 25 services. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
132 lines
3.2 KiB
Python
132 lines
3.2 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Docker API honeypot.
|
|
Serves a fake Docker REST API on port 2375. Responds to common recon
|
|
endpoints (/version, /info, /containers/json, /images/json) with plausible
|
|
but fake data. Logs all requests as JSON.
|
|
"""
|
|
|
|
import json
|
|
import os
|
|
import socket
|
|
from datetime import datetime, timezone
|
|
|
|
from flask import Flask, request
|
|
|
|
HONEYPOT_NAME = os.environ.get("HONEYPOT_NAME", "docker-host")
|
|
LOG_TARGET = os.environ.get("LOG_TARGET", "")
|
|
|
|
app = Flask(__name__)
|
|
|
|
_VERSION = {
|
|
"Version": "24.0.5",
|
|
"ApiVersion": "1.43",
|
|
"MinAPIVersion": "1.12",
|
|
"GitCommit": "ced0996",
|
|
"GoVersion": "go1.20.6",
|
|
"Os": "linux",
|
|
"Arch": "amd64",
|
|
"KernelVersion": "5.15.0-76-generic",
|
|
}
|
|
|
|
_INFO = {
|
|
"ID": "FAKE:FAKE:FAKE:FAKE",
|
|
"Containers": 3,
|
|
"ContainersRunning": 3,
|
|
"Images": 7,
|
|
"Driver": "overlay2",
|
|
"MemoryLimit": True,
|
|
"SwapLimit": True,
|
|
"KernelMemory": False,
|
|
"Name": HONEYPOT_NAME,
|
|
"DockerRootDir": "/var/lib/docker",
|
|
"HttpProxy": "",
|
|
"HttpsProxy": "",
|
|
"NoProxy": "",
|
|
"ServerVersion": "24.0.5",
|
|
}
|
|
|
|
_CONTAINERS = [
|
|
{
|
|
"Id": "a1b2c3d4e5f6",
|
|
"Names": ["/webapp"],
|
|
"Image": "nginx:latest",
|
|
"State": "running",
|
|
"Status": "Up 3 days",
|
|
"Ports": [{"IP": "0.0.0.0", "PrivatePort": 80, "PublicPort": 8080, "Type": "tcp"}],
|
|
}
|
|
]
|
|
|
|
|
|
def _forward(event: dict) -> None:
|
|
if not LOG_TARGET:
|
|
return
|
|
try:
|
|
host, port = LOG_TARGET.rsplit(":", 1)
|
|
with socket.create_connection((host, int(port)), timeout=3) as s:
|
|
s.sendall((json.dumps(event) + "\n").encode())
|
|
except Exception:
|
|
pass
|
|
|
|
|
|
def _log(event_type: str, **kwargs) -> None:
|
|
event = {
|
|
"ts": datetime.now(timezone.utc).isoformat(),
|
|
"service": "docker_api",
|
|
"host": HONEYPOT_NAME,
|
|
"event": event_type,
|
|
**kwargs,
|
|
}
|
|
print(json.dumps(event), flush=True)
|
|
_forward(event)
|
|
|
|
|
|
@app.before_request
|
|
def log_request():
|
|
_log(
|
|
"request",
|
|
method=request.method,
|
|
path=request.path,
|
|
remote_addr=request.remote_addr,
|
|
body=request.get_data(as_text=True)[:512],
|
|
)
|
|
|
|
|
|
@app.route("/version")
|
|
@app.route("/<ver>/version")
|
|
def version(ver=None):
|
|
return app.response_class(json.dumps(_VERSION), mimetype="application/json")
|
|
|
|
|
|
@app.route("/info")
|
|
@app.route("/<ver>/info")
|
|
def info(ver=None):
|
|
return app.response_class(json.dumps(_INFO), mimetype="application/json")
|
|
|
|
|
|
@app.route("/containers/json")
|
|
@app.route("/<ver>/containers/json")
|
|
def containers(ver=None):
|
|
return app.response_class(json.dumps(_CONTAINERS), mimetype="application/json")
|
|
|
|
|
|
@app.route("/images/json")
|
|
@app.route("/<ver>/images/json")
|
|
def images(ver=None):
|
|
return app.response_class(json.dumps([]), mimetype="application/json")
|
|
|
|
|
|
@app.route("/", defaults={"path": ""})
|
|
@app.route("/<path:path>", methods=["GET", "POST", "PUT", "DELETE"])
|
|
def catch_all(path):
|
|
return app.response_class(
|
|
json.dumps({"message": "page not found", "response": 404}),
|
|
status=404,
|
|
mimetype="application/json",
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
_log("startup", msg=f"Docker API honeypot starting as {HONEYPOT_NAME}")
|
|
app.run(host="0.0.0.0", port=2375, debug=False)
|