HoneyBot é um conjunto de scripts e bibliotecas para capturar e analisar capturas de pacotes com o PacketTotal.com. Atualmente, esta biblioteca fornece três scripts:

  • capture-and-analyze.py– Capture em uma interface por um período de tempo e faça upload da captura para análise.
  • upload-and-analyze.py – Carregue e analise várias capturas de pacotes no PacketTotal.com.
  • trigger-and-analyze.py– Ouça conexões desconhecidas e comece a capturar quando uma for feita. As capturas são carregadas e analisadas automaticamente.

Limitações

  • Somente arquivos .pcap e .pcapng são suportados.
  • Análise de 6 MB máx.

Para mais informações, visite PacketTotal.com .

Casos de Uso

  1. Configure seu honeypot para transmitir o tráfego de rede diretamente ao PacketTotal.com para análise.
  2. Analise um repositório pessoal de PCAPs maliciosos.
  3. Determine a benignidade de centenas de capturas de pacotes.
  4. Automatize a análise (e o compartilhamento) de capturas de pacotes honeypot.
  5. Automatize a análise / triagem preliminar de malware .

Pré-requisitos:

  • O WireShark deve estar instalado.
    • Se você estiver em um sistema operacional baseado em Linux, basta instalar o t-shark
      • apt-get install tshark
  • É necessário o Python 3.5 ou posterior.
  • Você deve solicitar uma chave API , antes de poder aproveitar esses scripts.

Instalação

  • pip install -r requirements.txt
  • python setup.py install

Uso

capture-and-analyze.py

usage: capture-and-analyze.py [-h] [--seconds SECONDS] [--interface INTERFACE]
                              [--analyze] [--list-interfaces] [--list-pcaps]
                              [--export-pcaps]

Capture, upload and analyze network traffic; powered by PacketTotal.com.

optional arguments:
  -h, --help            show this help message and exit
  --seconds SECONDS     The number of seconds to capture traffic for.
  --interface INTERFACE
                        The name of the interface (--list-interfaces to show
                        available)
  --analyze             If included, capture will be uploaded for analysis to
                        PacketTotal.com.
  --list-interfaces     Lists the available interfaces.
  --list-pcaps          Lists pcaps submitted to PacketTotal.com for analysis.
  --export-pcaps        Writes pcaps submitted to PacketTotal.com for analysis
                        to    a csv file.

upload-and-analyze.py

usage: upload-and-analyze.py [-h] [--path PATH [PATH ...]] [--analyze]
                             [--list-pcaps] [--export-pcaps]

Upload and analyze .pcap/.pcapng files in bulk; powered by PacketTotal.com.

optional arguments:
  -h, --help            show this help message and exit
  --path PATH [PATH ...]
                        One or more paths to pcap or directory of pcaps.
  --analyze             If included, capture will be uploaded for analysis to
                        PacketTotal.com.
  --list-pcaps          Lists pcaps submitted to PacketTotal.com for analysis.
  --export-pcaps        Writes pcaps submitted to PacketTotal.com for analysis
                        to a csv file.

trigger-and-analyze.py

usage: trigger-and-analyze.py [-h] [--interface INTERFACE] [--learn LEARN]
                              [--listen] [--capture-seconds CAPTURE_SECONDS]
                              [--list-interfaces] [--list-pcaps]
                              [--export-pcaps]

Listen for unknown connections, and begin capturing when one is made. Captures
are automatically uploaded and analyzed; powered by PacketTotal.com

optional arguments:
  -h, --help            show this help message and exit
  --interface INTERFACE
                        The name of the interface (--list-interfaces to show
                        available)
  --learn LEARN         The number of seconds from which to build the known
                        connections whitelist. Connections in this whitelist
                        will be ignored.
  --listen              If included, we will begin listening for unknown
                        con   nections, and immediately starting a packet capture
                        and uploading to PacketTotal.com for analysis.
  --capture-seconds CAPTURE_SECONDS
                        The number of seconds worth of network traffic to
                        capture and analyze after a trigger has fired.
  --list-interfaces     Lists the available interfaces.
  --list-pcaps          Lists pcaps submitted to PacketTotal.com for analysis.
  --export-pcaps        Writes pcaps submitted to PacketTotal.com for analysis
                        to a csv file.
Download
Hacking Grupo Telegram