feat: capture and log attacker input from Telnet sessions#15
Open
vinayaktyagi10 wants to merge 3 commits intohoneynet:mainfrom
Open
feat: capture and log attacker input from Telnet sessions#15vinayaktyagi10 wants to merge 3 commits intohoneynet:mainfrom
vinayaktyagi10 wants to merge 3 commits intohoneynet:mainfrom
Conversation
- Add non-blocking read() after each IAC write in the queue loop - Sanitize input: replace non-printable bytes and IAC sequences with '.' - Emit 'Telnet action <ip> <data>' metric via sendMetric on each read - Handle r==0 (client disconnected) with proper disconnect metric - Data is logged immediately per read for real-time visibility
- Add telnetInput CounterVec with labels 'ip' and 'data' - Handle 'action' command in handleMetric switch - Guard against malformed metric lines with len(fields) check
Uday9909
added a commit
to Uday9909/EventHorizon
that referenced
this pull request
Mar 23, 2026
Add mqtt_pit_payload_captured Prometheus metric that records attacker-supplied data from three MQTT packet types: - CONNECT: client_id, username, protocol version (password never captured) - PUBLISH: topic name and payload - SUBSCRIBE: topic filter Follows the same sendMetric() unixgram IPC pattern as PR honeynet#15. Safety: - Passwords skipped entirely, never passed to any metric - Binary payloads sanitized to printable ASCII - All fields truncated at 256 bytes - Malformed packets handled without crash - NULL guards on all capture functions Also removes password from existing credentials metric emission. Old code sent username and password. New code sends username only. Adds uint16_t port to struct mqttClient for source port labeling.
Author
|
Update: Removed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds real-time attacker input capture to the Telnet tarpit, logging
what attackers send during sessions as Prometheus metrics.
Changes
servers/telnet_pit.c
sequences (>126 or <32) with '.'
Telnet action <ip> <data>metric via sendMetric on each readmetric and cleanup
prometheus/main.go
telnet_pit_inputCounterVec with labelsipanddataactioncommand in handleMetric switch statementWhy
The Telnet pit previously discarded all data sent by attackers.
This change captures that data in real-time, enabling researchers
to observe attacker behavior and build datasets of credentials and
commands used in the wild.
Testing
Tested locally by connecting via
ncand typing input. ConfirmedTelnet action <ip> <data>lines appear in server output perkeystroke. Graceful shutdown confirmed still working after changes.