https://github.com/nao-sec/starc

Simple high-interactive client honeypot
https://github.com/nao-sec/starc

Last synced: 3 months ago
JSON representation

Simple high-interactive client honeypot

• Host: GitHub
• URL: https://github.com/nao-sec/starc
• Owner: nao-sec
• Created: 2017-06-16T11:19:56.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2017-10-15T12:33:54.000Z (about 7 years ago)
• Last Synced: 2024-07-17T10:57:37.105Z (4 months ago)
• Language: C#
• Homepage:
• Size: 25.4 KB
• Stars: 24
• Watchers: 2
• Forks: 5
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-honeypot - **18**星 - interactive client honeypot (<a id="a53d22b9c5d09dc894413453f4755658"></a>未分类)

README

        
# StarC

Simple high-interactive client honeypot for traffic analysis of Drive-by Download

## Require

- Windows

  - Host

  - Guest

    - Windows

- Virtual Box

- OpenVPN

  - Server

  - Client Software

- Wireshark

- Fiddler

- Git

## Setup

1. Setup OpenVPN Server  

2. Install Virtual Box on Host  

Please set PATH so that ```VBoxManage.exe``` can be used  

3. Install Git for Windows on Host  

Create repository to store the data  

Repository's name is "```starc.log```"  

Please also set ssh key  

Please clone directly below the drive (```C:\starc.log```)  

4. Install Windows on VM  

VM's name is "```starc```"  

No Login Password  

No UAC  

Create very vulnerable VM  

5. Install OpenVPN Client on VM  

Be sure to connect confirmation!  

Please put a config file named vpn.ovpn under ```C:\starc.log\config``` on Host  

6. Install Wireshark on VM  

Please set PATH so that ```tshark.exe``` can be used  

7. Install Fiddler on VM  

Please set PATH so that ```fiddler.exe``` & ```execaction.exe``` can be used  

Please make the appropriate settings, ```Decrypt HTTPS traffic```  

8. Make initial setting of Internet Explorer on VM

9. Delete all files under ```%temp%``` as much as possible on VM

10. Set ```starc.client.exe``` to startup on VM

11. Change VM settings  

Delete clipboard share setting  

Delete drag and drop setting  

Delete share folder setting  

12. Create snapshot of VM  

Snapshot's name is "```setuped```"  

## Usage

```

$ starc.exe [URL]

```