Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/nao-sec/starc
Simple high-interactive client honeypot
https://github.com/nao-sec/starc
Last synced: 26 days ago
JSON representation
Simple high-interactive client honeypot
- Host: GitHub
- URL: https://github.com/nao-sec/starc
- Owner: nao-sec
- Created: 2017-06-16T11:19:56.000Z (over 7 years ago)
- Default Branch: master
- Last Pushed: 2017-10-15T12:33:54.000Z (about 7 years ago)
- Last Synced: 2024-08-04T23:09:07.853Z (4 months ago)
- Language: C#
- Homepage:
- Size: 25.4 KB
- Stars: 24
- Watchers: 2
- Forks: 5
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-honeypot - **18**星 - interactive client honeypot (<a id="a53d22b9c5d09dc894413453f4755658"></a>未分类)
README
# StarC
Simple high-interactive client honeypot for traffic analysis of Drive-by Download
## Require
- Windows
- Host
- Guest
- Windows
- Virtual Box
- OpenVPN
- Server
- Client Software
- Wireshark
- Fiddler
- Git
## Setup
1. Setup OpenVPN Server
2. Install Virtual Box on Host
Please set PATH so that ```VBoxManage.exe``` can be used
3. Install Git for Windows on Host
Create repository to store the data
Repository's name is "```starc.log```"
Please also set ssh key
Please clone directly below the drive (```C:\starc.log```)
4. Install Windows on VM
VM's name is "```starc```"
No Login Password
No UAC
Create very vulnerable VM
5. Install OpenVPN Client on VM
Be sure to connect confirmation!
Please put a config file named vpn.ovpn under ```C:\starc.log\config``` on Host
6. Install Wireshark on VM
Please set PATH so that ```tshark.exe``` can be used
7. Install Fiddler on VM
Please set PATH so that ```fiddler.exe``` & ```execaction.exe``` can be used
Please make the appropriate settings, ```Decrypt HTTPS traffic```
8. Make initial setting of Internet Explorer on VM
9. Delete all files under ```%temp%``` as much as possible on VM
10. Set ```starc.client.exe``` to startup on VM
11. Change VM settings
Delete clipboard share setting
Delete drag and drop setting
Delete share folder setting
12. Create snapshot of VM
Snapshot's name is "```setuped```"
## Usage
```
$ starc.exe [URL]
```