class

Honeypot::Detection

Inherits Reference < Object

Detect exploitation/enumeration attempts

TODO: Score based detection

Constants

SAFE_PATHS = ["/", "/robots.txt", "/sitemap.xml", "/favicon.ico", "/index.html", "/wiki", "/.well-known/security.txt"]
SAFE_UAS = ["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity", "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36"]

Constructors

new(request : HTTP::Request)
Source

Instance methods

comment
Source
detect_loader

Detect a loading attempt by performing checks on both body and path.

Source
detect_ua

Detect unusual user agents

Source
is_enumeration(path : String) : String | Nil

Detect enumeration attempts

NOTE: Based on path

Source
is_exploit(path : String) : String | Nil

Detect exploitation attempts

NOTE: Based on path TODO: Load those from a file instead of hardcoding em

Source
judge

Judge a request as good or bad

Source