https://github.com/danielstephengilbert/the-watcher

A honeypot that tracks unique visitors to a web server then gathers intelligence on them.
https://github.com/danielstephengilbert/the-watcher

honeypot logging osint passive-recon php shodan-api sqlite traffic-analysis

Last synced: 14 days ago
JSON representation

A honeypot that tracks unique visitors to a web server then gathers intelligence on them.

• Host: GitHub
• URL: https://github.com/danielstephengilbert/the-watcher
• Owner: danielstephengilbert
• Created: 2023-09-01T04:20:24.000Z (about 1 year ago)
• Default Branch: main
• Last Pushed: 2023-09-06T03:10:25.000Z (about 1 year ago)
• Last Synced: 2024-08-11T05:37:32.207Z (3 months ago)
• Topics: honeypot, logging, osint, passive-recon, php, shodan-api, sqlite, traffic-analysis
• Language: PHP
• Homepage:
• Size: 359 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# The Watcher

Author: Daniel Gilbert (AdaptOrDie247)

A honeypot that logs traffic, with accompanying tools to analyze HTTP clients as well as perform passive recon on the client hosts.





## WARNING

If you make this application public-facing, make sure you know what you're doing.

Insecure deployment of the application can result in a system compromise, or worse.

## Quick Setup

1.  Install system dependencies: PHP, SQLite3.

2.  Git clone the repo.

3.  Install and run Composer to install the project dependencies.

4.  Create a `.env` file in the project root with the following values:

-   `database.directory`: The database directory. E.g., `writable/database`.

-   `database.name`: The database name. E.g., `the_watcher.db`.

-   `shodan.api_key`: A valid Shodan API key if you want to use the recon tools.

5.  Open a terminal in the `public` directory.

6.  Start the PHP web server: `php -S localhost:8000`.

7.  Navigate to `localhost:8000` in a web browser to log the request.

8.  Open a terminal in the `tools` directory.

9.  List the HTTP clients: `./get-http-clients.php`.

10. Perform passive recon on an IP address: `./recon-ip-address.php IP_ADDRESS`.