Skip to main content

Conpot is an ICS honeypot with the goal to collect intelligence about the motives and methods of adversaries targeting industrial control systems

Project description

Conpot |Build Status|
=======================

.. |Build Status| image:: https://travis-ci.org/glastopf/conpot.png?branch=master
:target: https://travis-ci.org/glastopf/conpot

ABOUT
-----

Conpot is an ICS honeypot with the goal to collect intelligence about the motives and
methods of adversaries targeting industrial control systems

DOCUMENTATION
-------------

The build of the documentations `source <https://github.com/glastopf/conpot/tree/master/docs/source>`_ can be
found `here <http://glastopf.github.io/conpot/>`_. There you will also find the instructions on how to
`install <http://glastopf.github.io/conpot/installation/ubuntu.html>`_ conpot and the
`FAQ <http://glastopf.github.io/conpot/faq.html>`_.

HPFEEDS
-------

The honeypot has hpfeeds, our central logging feature disabled by
default. By sending your data via hpfeeds you agree that your data
might be shared with 3rd parties. If you are interested in the data
collected by Conpot instances, please contact Lukas at
glaslos@gmail.com

SUPPORT
-------

Thanks to JetBrains for free PyCharm licenses!

SAMPLE OUTPUT
-------------

.. code-block:: shell

# conpot

_
___ ___ ___ ___ ___| |_
| _| . | | . | . | _|
|___|___|_|_| _|___|_|
|_|

Version 0.2.1
Glastopf Project

2013-05-11 18:47:16,434 Starting Conpot using template found in: /Users/jkv/repos/conpot/conpot/templates/default.xml
2013-05-11 18:47:16,435 Starting Conpot using configuration found in: /Users/jkv/repos/conpot/conpot/conpot.cfg
<configuration of slaves>
2013-05-11 18:47:16,435 Added slave with id 1.
2013-05-11 18:47:16,435 Added block a to slave 1. (type=1, start=1, size=128)
2013-05-11 18:47:16,436 Setting value at addr 1 to [random.randint(0,1) for b in range(0,128)].
2013-05-11 18:47:16,437 Conpot initialized using the S7-200 template.
2013-05-11 18:47:16,437 Modbus server started on: ('X.Y.Z.P', 502)
2013-05-11 18:47:16,569 Registered OID (1, 3, 6, 1, 2, 1, 1, 1) (sysDescr, SNMPv2-MIB) : Siemens, SIMATIC, S7-200
<snip>
2013-05-11 18:47:16,570 Starting SNMP server.
<attackers reads from modbus>
2013-05-11 18:49:42,315 Modbus traffic from X.Y.Z.P: {'function_code': 1, 'slave_id': 1, 'request': '0100010080', 'response': '011056412da0b5b5972c8e6f9204b561870b'} (1bfd5020-b0a1-41d1-b1ec-00a68321edca)
2013-05-11 18:49:42,326 Client disconnected. (1bfd5020-b0a1-41d1-b1ec-00a68321edca)
2013-05-11 18:49:42,326 New connection from X.Y.Z.P:49790. (3488c9d3-6e6d-4280-b3e1-32d70aa9f3aa)
<attackers write to modbus - if seen in the wild this would VERY malicious!>
2013-05-11 18:49:42,326 Modbus traffic from X.Y.Z.P: {'function_code': 15, 'slave_id': 1, 'request': '0f0001000801c9', 'response': '0f00010008'} (3488c9d3-6e6d-4280-b3e1-32d70aa9f3aa)
<attacker probes with snmp (snmpwalk -Os -c public -v 1 X.Y.Z.P system)>
2013-05-11 18:49:51,112 SNMPv1 request from ('X.Y.Z.P', 60934), Type: GetNextRequestPDU, Community: public, Oid: 1.3.6.1.2.1.1, Value:
2013-05-11 18:49:51,118 SNMPv1 reply to ('X.Y.Z.P', 60934), Type: GetResponsePDU, Community: public, Oid: 1.3.6.1.2.1.1.1.0, Value: Siemens, SIMATIC, S7-200
2013-05-11 18:49:51,119 SNMPv1 request from ('X.Y.Z.P', 60934), Type: GetNextRequestPDU, Community: public, Oid: 1.3.6.1.2.1.1.1.0, Value:
2013-05-11 18:49:51,121 SNMPv1 reply to ('X.Y.Z.P', 60934), Type: GetResponsePDU, Community: public, Oid: 1.3.6.1.2.1.1.2.0, Value: 0.0

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for Conpot, version 0.2.1
Filename, size File type Python version Upload date Hashes
Filename, size Conpot-0.2.1.tar.gz (28.0 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page