Giter VIP home page Giter VIP logo

mysqlhoneypot's Introduction

MysqlHoneypot

Use MySQL honeypot to get wechat ID

待解决问题:

  • 同一出口IP的不同攻击者的信息如何区分
  • 读取的文件较大时,客户端会分段传输,如何完整获取
  • 前端有点bug,不管了,能用就行了

Dokcer 部署

  1. 克隆本项目, 修改密码 MysqlHoneypot\webServer.py
# 请自行更改密码
users = {
    "admin": generate_password_hash("密码")
}
  1. 在本项目下面执行
docker-compose up -d

mysqlhoneypot's People

Contributors

etocheney avatar qigpig avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

mysqlhoneypot's Issues

Please i need help,docker-compose error

docker-compose up -d
[+] Building 138.1s (8/8) FINISHED docker:default
=> [web internal] load build definition from Dockerfile 0.1s
=> => transferring dockerfile: 195B 0.0s
=> [web internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [web internal] load metadata for docker.io/qzkc/python2.7:v2 16.1s
=> [web internal] load build context 0.0s
=> => transferring context: 671.25kB 0.0s
=> [web 1/4] FROM docker.io/qzkc/python2.7:v2@sha256:aded04c80df6db49e939d74d1dd89e6c270038f2ca041ea380ebd139f2849370 21.2s
=> => resolve docker.io/qzkc/python2.7:v2@sha256:aded04c80df6db49e939d74d1dd89e6c270038f2ca041ea380ebd139f2849370 0.0s
=> => sha256:b7354d80806adb338049108453f8638a0f2a1db9c2e840bef7e40aface40929c 3.59kB / 3.59kB 0.0s
=> => sha256:618699ec6cd5d8b1f623ca84148ca09c3951ca9fbb4c58a893e60c1281ddc00c 3.40MB / 3.40MB 1.1s
=> => sha256:aded04c80df6db49e939d74d1dd89e6c270038f2ca041ea380ebd139f2849370 1.79kB / 1.79kB 0.0s
=> => sha256:638b75f800bffbc01324705aed0754a00532dd051b57198af824d5e13ffb140b 61.58MB / 61.58MB 13.8s
=> => sha256:c2b55cf1d99d32987a8fb4b8883d1cf44c0f2fd596cfccb63ab8a1ca392fd9dc 93B / 93B 1.1s
=> => sha256:60a0793c63a4d74ab08d501653ac44b28ddbb027c64d20ed1b294a2b9bd1a61a 58.07MB / 58.07MB 12.7s
=> => sha256:7cc0a306513dee02a1367b37f5dd074a4f6005d246d0b29710821c06e6452a99 16.66MB / 16.66MB 7.3s
=> => sha256:b7ade8636cce227b2c4395d9e71daf586054e87aebf7fe9916a57f771b77ddfb 1.88MB / 1.88MB 8.3s
=> => sha256:4c15d35f3ec49800e53a29780dfb15efa585aa6cd8b3d71619187650e4a18f4f 1.06MB / 1.06MB 9.1s
=> => extracting sha256:638b75f800bffbc01324705aed0754a00532dd051b57198af824d5e13ffb140b 3.6s
=> => extracting sha256:c2b55cf1d99d32987a8fb4b8883d1cf44c0f2fd596cfccb63ab8a1ca392fd9dc 0.0s
=> => extracting sha256:618699ec6cd5d8b1f623ca84148ca09c3951ca9fbb4c58a893e60c1281ddc00c 0.2s
=> => extracting sha256:60a0793c63a4d74ab08d501653ac44b28ddbb027c64d20ed1b294a2b9bd1a61a 2.1s
=> => extracting sha256:7cc0a306513dee02a1367b37f5dd074a4f6005d246d0b29710821c06e6452a99 0.7s
=> => extracting sha256:b7ade8636cce227b2c4395d9e71daf586054e87aebf7fe9916a57f771b77ddfb 0.1s
=> => extracting sha256:4c15d35f3ec49800e53a29780dfb15efa585aa6cd8b3d71619187650e4a18f4f 0.1s
=> [web 2/4] COPY ./ /mysqlhoneypot/ 0.4s
=> [web 3/4] WORKDIR /mysqlhoneypot 0.0s
=> ERROR [web 4/4] RUN pip install flask && pip install Flask-HTTPAuth 100.2s

[web 4/4] RUN pip install flask && pip install Flask-HTTPAuth:
0.678 WARNING: Running pip install with root privileges is generally not a good idea. Try pip install --user instead.
0.691 Requirement already satisfied: flask in /usr/lib64/python2.7/site-packages
0.702 Requirement already satisfied: Werkzeug>=0.14 in /usr/lib/python2.7/site-packages (from flask)
0.708 Requirement already satisfied: click>=5.1 in /usr/lib64/python2.7/site-packages (from flask)
0.709 Requirement already satisfied: itsdangerous>=0.24 in /usr/lib/python2.7/site-packages (from flask)
0.711 Requirement already satisfied: Jinja2>=2.10 in /usr/lib/python2.7/site-packages (from flask)
0.714 Requirement already satisfied: MarkupSafe>=0.23 in /usr/lib64/python2.7/site-packages (from Jinja2>=2.10->flask)
0.960 WARNING: Running pip install with root privileges is generally not a good idea. Try pip install --user instead.
1.004 Collecting Flask-HTTPAuth
9.360 Downloading https://files.pythonhosted.org/packages/22/21/0160aa217c4df74e44a04919213f9c8af7e68551c10267b055f1e09d421c/Flask-HTTPAuth-4.8.0.tar.gz (230kB)
99.92 Requirement already satisfied: flask in /usr/lib64/python2.7/site-packages (from Flask-HTTPAuth)
99.94 Requirement already satisfied: Werkzeug>=0.14 in /usr/lib/python2.7/site-packages (from flask->Flask-HTTPAuth)
99.94 Requirement already satisfied: click>=5.1 in /usr/lib64/python2.7/site-packages (from flask->Flask-HTTPAuth)
99.94 Requirement already satisfied: itsdangerous>=0.24 in /usr/lib/python2.7/site-packages (from flask->Flask-HTTPAuth)
99.94 Requirement already satisfied: Jinja2>=2.10 in /usr/lib/python2.7/site-packages (from flask->Flask-HTTPAuth)
99.95 Requirement already satisfied: MarkupSafe>=0.23 in /usr/lib64/python2.7/site-packages (from Jinja2>=2.10->flask->Flask-HTTPAuth)
99.95 Installing collected packages: Flask-HTTPAuth
99.95 Running setup.py install for Flask-HTTPAuth: started
100.1 Running setup.py install for Flask-HTTPAuth: finished with status 'error'
100.1 Complete output from command /usr/bin/python2 -u -c "import setuptools, tokenize;file='/tmp/pip-build-Fcufer/Flask-HTTPAuth/setup.py';f=getattr(tokenize, 'open', open)(file);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, file, 'exec'))" install --record /tmp/pip-2wK7i0-record/install-record.txt --single-version-externally-managed --compile:
100.1 running install
100.1 running build
100.1 running build_py
100.1 creating build
100.1 creating build/lib
100.1 copying src/flask_httpauth.py -> build/lib
100.1 running egg_info
100.1 error: 'egg_base' must be a directory name (got src)
100.1
100.1 ----------------------------------------
100.1 Command "/usr/bin/python2 -u -c "import setuptools, tokenize;file='/tmp/pip-build-Fcufer/Flask-HTTPAuth/setup.py';f=getattr(tokenize, 'open', open)(file);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, file, 'exec'))" install --record /tmp/pip-2wK7i0-record/install-record.txt --single-version-externally-managed --compile" failed with error code 1 in /tmp/pip-build-Fcufer/Flask-HTTPAuth/


failed to solve: executor failed running [/bin/sh -c pip install flask && pip install Flask-HTTPAuth]: exit code: 1

读取PFRO.log的问题以及连接mysql后一次读取多个客户端文件建议

1、PFRO.log中如果有多个用户名,读取的是第一个用户名,但是安装微信等路径的可能是其他的用户名安装的,导致读取不到文件。
如以下日志,wechat安装在coco用户下,但是脚本去访问Administrator去了。建议跑个循环,把所有用户名都读取一遍

1/29/2019 14:16:58 - PFRO Error: ??\C:\Users\Administrator\AppData\Local\Microsoft
1/29/2019 14:50:45 - PFRO Error: ??\C:\Users\ADMINI~1\AppData\Local\Temp
3/17/2019 15:30:38 - PFRO Error: ??\C:\Users\cocosec\AppData\

2、每次连接mysql后,脚本只能读取一次客户端文件,建议跑循环,一次读取客户端多个文件

解决读取大文件读不全问题

读取大文件解决思路:
发送访问文件的请求后,建立一个while循环,一直读取数据并且将每次读取的数据保存到变量或文件中,直到读取到的信息为空。

filename='C:/windows/pfro.log'
wantfile=chr(len(filename)+1)+"\x00\x00\x01\xFB"+filename
conn.sendall(wantfile)
conn.sendall('asdfsadfsadfsa') #随便发送的数据,为了让recv接收到空数据以退出循环,如果不发送会导致recv阻塞
content = 'asdfasdf' #初始进入循环
while len(content) !=0 :
    content=conn.recv(9999999)
    text = text + content
print text #这时的text是完整的数据

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.