DShield Docker Logo

DShield Docker

0
Free
Visit Website

This Docker container starts a SSH honeypot (based on Cowrie) and enables the DShield output module to report statistics to the SANS ISC DShield project. Building the image: # git clone https://github.com/xme/dshield-docker # cd dshield-docker # docker build -t dshield/honeypot . Running the image: First, create a configuration file which will contain your DShield account details: # cat env.txt DSHIELD_UID=xxxxxxxxxx DSHIELD_APIKEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx DSHIELD_EMAIL=xxxxxxxxxxxxxxxxxxx Your credentials will be validated and the honeyport properly configured. Don't forget to register[1] if you don't already have an account. [1] https://www.dshield.org/register.html Boot the container: # docker run -d -p 2222:2222 --env-file=env.txt --restart=always --name dshield dshield/honeypot b56e526b6f7c9b6cb419245757b0586f73d7e99089fa93409f3626122990505a # docker logs dshield Validating provided credentials... API key verification succeeded! Starting cowrie... The honeypot is listening to port

FEATURES

ALTERNATIVES

A tool to search for Sentry config on a page or in JavaScript files and check for blind SSRF

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

A repository of pre-defined detections for security threats and abnormal behaviors in Falco.

FingerprintX is a standalone utility for service discovery on open ports.

Tcpdump is a command-line packet analyzer for capturing and analyzing network traffic.

Tool used to scan a range of IP addresses to identify active hosts and gather information about them.

A tool for creating custom policies for IEE policies

Hale is a botnet command & control monitor/spy with a modular design and various monitoring capabilities, including IRC and HTTP, to aid in botnet hunting and research.