hacklcx/HFish
HFish
HFish este un sistem distribuit de tip honeypot și un instrument de detectare a intruziunilor în rețea, conceput pentru a implementa servicii și noduri momeală pentru a detecta și analiza comportamentul atacatorilor. Acesta funcționează ca un orchestrator de active înșelătoare care simulează servicii enterprise și configurează momeli personalizate pentru a atrage intrușii în rețea.
Sistemul utilizează o arhitectură server-client pentru a gestiona nodurile distribuite pe diferite platforme, permițând controlul centralizat al colectării telemetriei și implementarea momelilor. Acesta încorporează rutarea traficului bazată pe cloud pentru a redirecționa activitatea suspectă de rețea în medii momeală gestionate pentru capturarea și analiza centralizată a amenințărilor.
Platforma oferă capabilități pentru detectarea scanării rețelei pe porturi deschise și simularea diverselor servicii de rețea, inclusiv dispozitive IoT și sisteme CRM. Include un manager de telemetrie a amenințărilor și un dispatcher de alerte pluggable care rutează notificările de securitate prin email, webhooks, syslog și platforme de mesagerie enterprise.
Features
- Honeypot Management - Provides a comprehensive platform for deploying and controlling multiple decoy nodes from a centralized server.
- Honeypots and Deception - Deploys decoy services and nodes to detect and analyze attacker behavior across a distributed network.
- Deceptive Service Mocks - Emulates specific network protocols and services, such as IoT devices and CRM systems, to mislead attackers.
- Scanning Detection - Tracks activity across all open network ports to identify reconnaissance and unauthorized scanning patterns.
- Network Scanning Detection - Tracks network ports to identify reconnaissance activities and alert on unauthorized scanning attempts.
- Deceptive Asset Orchestrators - Functions as an orchestrator for configuring custom baits and simulating enterprise services to lure intruders.
- Deceptive Bait Configurations - Provides a way to define specific asset profiles and deceptive settings to lure network intruders.
- Honeypot Node Management - Controls remote telemetry collection points via a centralized server that coordinates deployment and data gathering.
- Network Deception Technologies - Creates fake network services and assets to lure attackers and detect unauthorized activity.
- Network Intrusion Detection - Monitors network traffic for suspicious patterns and reconnaissance attempts to alert administrators of potential intrusions.
- Threat Telemetry Collection - Collects interaction data from remote nodes using a server-client architecture to manage threat telemetry.
- Web Honeypots - Builds specialized web-based deceptive environments to lure attackers and capture interaction data.
- Traffic Routing - Implements mechanisms for directing suspicious network traffic to isolated decoy environments for centralized analysis.
- Decoy Redirections - Provides cloud-based traffic routing to redirect suspicious activity into managed decoy environments for centralized analysis.
- Threat Notification Systems - Sends real-time security notifications to administrators via webhooks, email, or messaging platforms.
- Notification Dispatchers - Dispatches threat alerts via email, syslog, webhooks, and enterprise messaging platforms.
- Distributed Node Lifecycles - Manages the deployment and supervision of remote decoy nodes across different platforms.
- Multi-Channel Alerting - Routes security notifications through multiple external channels including email, webhooks, and enterprise messaging systems.
- Honeypots - Deploys high-interaction honeypots for threat intelligence.
