• 39 Posts
  • 218 Comments
Joined 11 months ago
cake
Cake day: December 27th, 2024

help-circle










  • from flask import Flask, request, abort
    from datetime import datetime, timedelta
    import sqlite3
    import logging
    import os
    
    app = Flask(__name__)
    
    DB_FILE = "honeypot.db"
    #LOG_FILE = "/var/log/honeypot.log"
    LOG_FILE = "honeypot.log"
    
    TRAP_THRESHOLD = 3             # clicks before flagging
    FLAG_DURATION_HOURS = 24       # how long the flag lasts
    
    
    # --- Setup logging for Fail2Ban integration ---
    #os.makedirs(os.path.dirname(LOG_FILE), exist_ok=True)
    logging.basicConfig(
        filename=LOG_FILE,
        level=logging.INFO,
        format="%(asctime)s [%(levelname)s] %(message)s",
    )
    
    
    # --- Database setup ---
    def init_db():
        with sqlite3.connect(DB_FILE) as conn:
            c = conn.cursor()
            c.execute("""
                CREATE TABLE IF NOT EXISTS hits (
                    ip TEXT,
                    ts DATETIME
                )
            """)
            c.execute("""
                CREATE TABLE IF NOT EXISTS flagged (
                    ip TEXT PRIMARY KEY,
                    flagged_on DATETIME,
                    expires DATETIME
                )
            """)
            conn.commit()
    
    
    # --- Helper functions ---
    def record_hit(ip):
        now = datetime.utcnow()
        with sqlite3.connect(DB_FILE) as conn:
            c = conn.cursor()
            c.execute("INSERT INTO hits (ip, ts) VALUES (?, ?)", (ip, now))
            conn.commit()
    
    
    def get_hit_count(ip):
        with sqlite3.connect(DB_FILE) as conn:
            c = conn.cursor()
            c.execute("SELECT COUNT(*) FROM hits WHERE ip = ?", (ip,))
            return c.fetchone()[0]
    
    
    def flag_ip(ip):
        now = datetime.utcnow()
        expires = now + timedelta(hours=FLAG_DURATION_HOURS)
        with sqlite3.connect(DB_FILE) as conn:
            c = conn.cursor()
            c.execute("REPLACE INTO flagged (ip, flagged_on, expires) VALUES (?, ?, ?)",
                      (ip, now, expires))
            conn.commit()
        logging.warning(f"HONEYPOT flagged {ip} for {FLAG_DURATION_HOURS}h")  # Fail2Ban picks this up
    
    
    def is_flagged(ip):
        now = datetime.utcnow()
        with sqlite3.connect(DB_FILE) as conn:
            c = conn.cursor()
            c.execute("SELECT expires FROM flagged WHERE ip = ?", (ip,))
            row = c.fetchone()
            if not row:
                return False
            expires = datetime.fromisoformat(row[0])
            if now < expires:
                return True
            # Expired flag, remove it
            c.execute("DELETE FROM flagged WHERE ip = ?", (ip,))
            conn.commit()
            return False
    
    
    # --- Middleware ---
    @app.before_request
    def block_flagged():
        ip = request.remote_addr
        if is_flagged(ip):
            abort(403, description="Access denied (you have been flagged).")
    
    
    # --- Routes ---
    @app.route('/')
    def home():
        return '''
            <h1>Welcome</h1>
            <p><a href="/do_not_click">Don’t click this unless you are a bot</a></p>
        '''
    
    
    @app.route('/robots.txt')
    def robots_txt():
        return "User-agent: *\nDisallow: /do_not_click\n", 200, {'Content-Type': 'text/plain'}
    
    
    @app.route('/do_not_click')
    def honeypot():
        ip = request.remote_addr
    
        if is_flagged(ip):
            abort(403, description="Access denied (you’ve been flagged).")
    
        record_hit(ip)
        hit_count = get_hit_count(ip)
        logging.info(f"HONEYPOT triggered by {ip} (count={hit_count})")
    
        if hit_count >= TRAP_THRESHOLD:
            flag_ip(ip)
            return "You’ve been flagged for suspicious behavior.", 403
    
        return f"Suspicious activity detected ({hit_count}/{TRAP_THRESHOLD})."
    
    
    if __name__ == "__main__":
        init_db()
        app.run(debug=True)
    

    Here I condensed this down to its parts. Hopefully this works well for you.





  • mesa@piefed.socialtoLemmy@lemmy.mlAdmins: Set up Anubis ASAP!
    link
    fedilink
    English
    arrow-up
    17
    ·
    edit-2
    8 days ago

    I created a honeypot that is only accessible if they click the “don’t click this unless you are a bot”. If they do after 3 times, poof the IP gets banned for a day. Its worked well.

    Simple little flask app. Robots.text as well but only google seems to actually read that and respect it.




  • I think I get what your saying. LOL LLM bots stealing all the things.

    You may note, im not arguing the ethical concerns of LLMs, just the way it was pulled. Its why open source models that pull data and let others have full access to said data could be argued as more ethical. For practical purposes, it means we can just pull them off hugging face and use them on our home setups. And reproduce them with the “correct” datasets. As always garbage in/ garbage out. I wish my work would allow me to put all the SQL over a 30(?) year period into a custom LLM just for our proprietary BS. Thats something I would have NO ethical concerns about at all.



  • I just hate that they stole all that licensed code.

    It feels so wrong that people are paying to get access to code…that others put out there as open source. You can see the GPL violations sometimes when it outputs some code from doom or other such projects. Some function made with the express purpose for that library, only to be used to make Microsoft shareholders richer. And to eventually remove the developer from the development. Its really sad and makes me not want to code on GitHub. And ive been on the platform for 15+ years.

    And theres been an uptick in malware libraries that are propagating via Claude. One such example: https://www.greenbot.com/ai-malware-hunt-github-accounts/

    At least with the open source models, you are helping propagate actual free (as in freedom) LLMs and info.