{"id":17212308,"url":"https://github.com/kung-foo/freki","last_synced_at":"2025-04-13T22:32:01.768Z","repository":{"id":57489102,"uuid":"77829653","full_name":"kung-foo/freki","owner":"kung-foo","description":"Freki is a tool to manipulate packets in usermode using NFQUEUE and golang.","archived":false,"fork":false,"pushed_at":"2023-02-02T12:03:16.000Z","size":12461,"stargazers_count":58,"open_issues_count":3,"forks_count":11,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-03-27T12:52:41.042Z","etag":null,"topics":["golang","honeypot","nfqueue"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kung-foo.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-01-02T11:42:54.000Z","updated_at":"2024-09-30T07:06:55.000Z","dependencies_parsed_at":"2023-02-17T19:25:19.042Z","dependency_job_id":null,"html_url":"https://github.com/kung-foo/freki","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kung-foo%2Ffreki","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kung-foo%2Ffreki/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kung-foo%2Ffreki/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kung-foo%2Ffreki/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kung-foo","download_url":"https://codeload.github.com/kung-foo/freki/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248790665,"owners_count":21162069,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","honeypot","nfqueue"],"created_at":"2024-10-15T02:59:46.070Z","updated_at":"2025-04-13T22:32:01.421Z","avatar_url":"https://github.com/kung-foo.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"freki\n=====\n\n[![Travis](https://img.shields.io/travis/kung-foo/freki/master.svg?style=flat-square)](https://travis-ci.org/kung-foo/freki)\n\nThe ravenous and greedy one.\n\n**Freki** is a tool for manipulating packets in userspace. Using iptable's raw table, packets are routed down into userspace where **freki** takes over. A set of rules is applied allowing for a large amount of flexibility. For example, you can forward all TCP ports to an HTTP honeypot and log the requests. Or you can proxy TCP port 22 into a docker container running an ssh honeypot.\n\nThere are currently two builtin loggers:\n\n`log_tcp`: reads up to 1024 bytes from the connection, and then closes it.\n\n`log_http`: sends a 200 OK back on every request.\n\nAdditionally, there are three mangling behaviors:\n\n`rewrite`: Rewrites the incoming packet's destination port\n\n`proxy`: Creates a TCP proxy for the connection to the specified target (can be an IP address, host name, or docker container)\n\n`user_conn`: When using **freki** as a library, invoke a user-specified\ncallback with a `net.Conn`\n\n```\n$ ./bin/freki --help\nUsage:\n    freki [options] [-v ...] -i=\u003cinterface\u003e -r=\u003crules\u003e\n    freki -h | --help | --version\nOptions:\n    -i --interface=\u003ciface\u003e  Bind to this interface.\n    -r --rules=\u003crules\u003e      Rules file.\n    -h --help               Show this screen.\n    --version               Show version.\n    -v                      Enable verbose logging (-vv for very verbose)\n```\n\nBuild\n-----\n\nrequires: go 1.7+, libnetfilter-queue-dev\u003e=1.0.0, libpcap-dev, iptables-dev\n\n\nRules Specification\n-------------------\n\nRules are applied in order (top down) and stop after a match is found. The `match` field (required) is written using [BPF filter](https://biot.com/capstats/bpf.html) syntax. Note: not all filters may apply. For example, the ethernet src and dst headers are generally zero'd out.\n\n```yaml\nrules:\n  # allow packets from your machine (1.2.3.4) to reach your ssh server\n  - match: tcp dst port 22 and src host 1.2.3.4\n    type: passthrough\n  # send all tcp coming in on 10022 to 22\n  - match: tcp dst port 10022\n    type: rewrite\n    target: 22\n  # proxy all packets coming in on 6379 on to a container named 'redis' (must exist at the time freki starts)\n  - match: tcp dst port 6379\n    type: proxy\n    target: docker://redis:6379\n  # proxy all packets coming in on 666 out to portquiz.net:666\n  - match: tcp dst port 666\n    type: proxy\n    target: tcp://portquiz.net:666\n  # log http requests on 80 and 8080\n  - match: tcp port 80 or tcp port 8080\n    type: log_http\n  # pass connections on 7000 through 8000 to a registered handler called 'echo'\n  - match: tcp portrange 7000-8000\n    type: conn_handler\n    target: echo\n  # drop (no FIN, nothing!)\n  - match: tcp portrange 5000-5010\n    type: drop\n  # forward all remaining tcp packets to a tcp logger. grabs 1024 bytes and then closes.\n  - match: tcp\n    type: log_tcp\n  - match:\n    type: passthrough\n```\n\nNotes\n-----\n\nIf **freki** hangs or panics, it may leave two iptables rules in place.\n\nThe simple fix is: `sudo iptables -t raw -F`.\n\nContributors\n------------\n\n* [Jonathan Camp](https://keybase.io/kung_foo)\n* [Lukas Rist](https://keybase.io/glaslos)\n* Mohammad Bilal\n\nLicense\n-------\n_freki_ is distributed under the terms of the MIT License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkung-foo%2Ffreki","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkung-foo%2Ffreki","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkung-foo%2Ffreki/lists"}