gbrindisi / wordpot Goto Github PK

wordpot.txt
I cannot get wordpot to start because it is trying to connect to a server via hpfeeds and it doesn't connect.

Could it be possible to have the default wp-content directory instead of static ?

ie : /static/twentyeleven/style.css => /wp-content/themes//twentyeleven/style.css

or, at least /static/themes//twentyeleven/style.css (the static will be detected as a custom wp-content dir by wpscan)

In that way, wpscan will be able to work correctly for this pot :)

Futhermore, could be interesting to have a wpscan detection :D (if the pot detected that wpscan is scanning, add it to the log file)

It's really usefull for the wpscan dev, as i can check if the requets are done correctly w/o reading the log file of the wordpress in my VM :D

It seems that this honeypot does not attract attackers on my servers unlike other web services honeypots. (glastopf, shockpot)

Possible reason is that this honeypot shows the following fingerprint on nmap scan for port 80:
80/tcp open http Werkzeug httpd 0.10.4 (Python 2.7.6)

(Honeypots like glastopf or shockpot show Apache httpd 2.x.x fingerprints.)

it would be possible to add a similar fingerprint for wordpot ?

The last version always says that i must install flask, but its installed :

pip install flask
Requirement already satisfied (use --upgrade to upgrade): flask in /usr/lib/pymodules/python2.6
Requirement already satisfied (use --upgrade to upgrade): Werkzeug>=0.6.1 in /usr/lib/pymodules/python2.6 (from flask)
Requirement already satisfied (use --upgrade to upgrade): Jinja2>=2.4 in /usr/lib/pymodules/python2.6 (from flask)
Cleaning up...

In the previous version i don't got that (except the first time, when flask was not installed xD)

Btw, if i remove the try except, i have this :

File "wordpot.py", line 4, in
from flask import Flask, request, render_template, make_response, url_for, redirect
ImportError: cannot import name make_response

So, it can not import the module make_response from flask, why ? xD

i have install wordpot from docker hub https://hub.docker.com/r/garland/wordpot, but i don't know how to send log data to HPFEEDS, any one can help me?

Could we have an argument to use another config file ? (like i've done in wpscan ;p) :D

after scanning a server I can see the webserver info is Werkzeug/0.10.4 Python/2.7.3
So if i see this I know not to "hack" it and its a trap...
Is there a way to change the info for the webserver identifying itself?

May i suggest you to add a .gitignore file with at least *.pyc into it ? ;)

As the logs directory does not exist, an error occured :

Traceback (most recent call last):
File "wordpot.py", line 37, in
logging_setup()
File "/home/wordpot/wordpot/logger.py", line 9, in logging_setup
fh = logging.handlers.RotatingFileHandler('logs/wordpot.log', 'a', 2097152, 10)
File "/usr/lib/python2.6/logging/handlers.py", line 112, in init
BaseRotatingHandler.init(self, filename, mode, encoding, delay)
File "/usr/lib/python2.6/logging/handlers.py", line 64, in init
logging.FileHandler.init(self, filename, mode, encoding, delay)
File "/usr/lib/python2.6/logging/init.py", line 827, in init
StreamHandler.init(self, self._open())
File "/usr/lib/python2.6/logging/init.py", line 846, in _open
stream = open(self.baseFilename, self.mode)
IOError: [Errno 2] No such file or directory: '/home/wordpot/logs/wordpot.log'

To create an empty dir in a git repo : http://stackoverflow.com/questions/115983/how-do-i-add-an-empty-directory-to-a-git-repository

Hey Hey, it's me again ;p

At this time, all plugins are detected in the pot (with the 200 status code), maybe you could just give a 200 for a list of user defined plugins ? (and if the list does not exist, let wordpot acts like now)

Example :

if i have the plugin list ["count-per-day", "wp-security"] in the conf, wordpot will only give a 200 for those plugins

If you do that, do not forget to give a 200 to all the files requested in those plugins dir ;) (count-per-day/readme.txt etc)