idanless / canarytcppy

like Canarytokens this can be triggered every time someone is scan you

Welcome to CanaryTCPpy

CanaryTCPpy is a project inspired by "Canarytokens" that can handle and trigger alerts when scanned by tools like Nmap, Masscan, etc. It utilizes the basic RFC of TCP to create a deception mechanism. By blocking the RST TCP flag, the scanner and hacker remain unaware that the services are fake or the ports are closed.

How CanaryTCPpy can help you:

1. Set it up on your WAN (Wide Area Network) and trigger alerts to detect and investigate potential network intrusions.
2. Monitor your network for any suspicious activity by identifying small Docker containers or Linux instances that may indicate attempts to "jump" to other servers.
3. And more! Combine CanaryTCPpy with other security tools to build an active monitoring system, such as an Intrusion Detection System (IDS).

Example Flow Picture: TCP3 Flow Handling

Here's an example picture tcp 3 handshake flow:

Example Picture: Network Area

Here's an example picture showcasing the network area:

Example: Nmap Scan Result

When an attacker scans a system running CanaryTCPpy with Nmap, the fake port is typically marked as yellow, indicating that it appears closed or filtered [you test by any nmap online or local]:

Getting Started

To run the project, follow these steps:

1. Clone the repository to your local machine.
2. Install Scapy, preferably using package managers like apt or yum.
3. Run the provided examples in the code.
4. run as sudo or root