https://github.com/jblukach/lunkerzero
Lunker Zero, a.k.a. LZ, performs Threat Surface monitoring with ChatOps to detect Internet-accessible network risk and Open Source Intelligence reputation.
https://github.com/jblukach/lunkerzero
attack aws cdk docker exposure osint port python surface threat
Last synced: about 1 year ago
JSON representation
Lunker Zero, a.k.a. LZ, performs Threat Surface monitoring with ChatOps to detect Internet-accessible network risk and Open Source Intelligence reputation.
- Host: GitHub
- URL: https://github.com/jblukach/lunkerzero
- Owner: jblukach
- License: apache-2.0
- Created: 2024-06-23T13:21:27.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2025-01-08T01:03:41.000Z (over 1 year ago)
- Last Synced: 2025-01-08T02:18:54.224Z (over 1 year ago)
- Topics: attack, aws, cdk, docker, exposure, osint, port, python, surface, threat
- Language: Python
- Homepage: https://search.censys.io
- Size: 1.69 MB
- Stars: 1
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# lunkerzero
Lunker Zero, a.k.a. LZ, performs Threat Surface monitoring with ChatOps to detect Internet-accessible network risk and Open Source Intelligence reputation.
The application has three environments for developing new detections that can be promoted once ready.
- Development
- Guinea Pigs
- Production
Threat Surface monitoring results get separated by deploying new **code names** for each Amazon Web Services (AWS) cloud investigation.
- Walleye
- Perch
- Northern
Slack notifications are received when a monitored DNS, IPv4, or IPv6 is added/removed from checked OSINT threat feeds.
Censys Search also provides Slack notifications when ports are opened/closed from the Autonomous System (AS) number query results.
https://search.censys.io
Lastly, the Webrecorder project archives websites for inspection using Amazon GuardDuty & Macie for malicious and sensitive content detection.
https://github.com/webrecorder
## AWS Chatbot for Slack
### Add Artifact
```
@aws invoke walleye --payload {"add”: “4n6ir.com”}
```
```
@aws invoke walleye --payload {"add”: “127.0.0.1”}
```
```
@aws invoke walleye --payload {"add”: “::1”}
```
### List Artifacts
```
@aws invoke walleye --payload {"list”: “all”}
```
```
@aws invoke walleye --payload {"list”: “dns”}
```
```
@aws invoke walleye --payload {"list”: “ipv4”}
```
```
@aws invoke walleye --payload {"list”: “ipv6”}
```
### Remove Artifact
```
@aws invoke walleye --payload {"remove”: “4n6ir.com”}
```
```
@aws invoke walleye --payload {"remove”: “127.0.0.1”}
```
```
@aws invoke walleye --payload {"remove”: “::1”}
```
### Delete Artifacts
```
@aws invoke walleye --payload {"delete”: “all”}
```
```
@aws invoke walleye --payload {"delete”: “dns”}
```
```
@aws invoke walleye --payload {"delete”: “ipv4”}
```
```
@aws invoke walleye --payload {"delete”: “ipv6”}
```
### Autonomous System
```
@aws invoke walleye --payload {"as”:”AS65535”}
```
```
@aws invoke walleye --payload {"handle”:”FAKE-1”}
```
```
@aws invoke walleye --payload {"list”: “as”}
```
```
@aws invoke walleye --payload {"delete”: “as”}
```
### Classless Inter-Domain Routing
```
@aws invoke walleye --payload {"cidr”:”127.0.0.1/24”}
```
```
@aws invoke walleye --payload {"list”: “cidr”}
```
```
@aws invoke walleye --payload {"delete”: “cidr”}
```
## Amazon EventBridge Rules
### Censys Search
```
{"censys”: “search”}
```
### Open Source Intelligence
```
{"osint”: “dns”}
```
```
{"osint”: “ipv4”}
```
```
{"osint”: “ipv6”}
```
## Amazon GuardDuty & Macie
### Website Inspection
```
@aws invoke walleye --payload {"inspect”: “https://4n6ir.com”}
```