Portspoof
Overview
섹션 제목: “Overview”Portspoof is a sophisticated network deception tool that emulates legitimate services and responds to connection attempts with valid service signatures. It can bind to arbitrary ports and respond with authentic-looking banners and responses from popular services (HTTP, SSH, SMTP, DNS, etc.), deceiving port scanners, fingerprinting tools, and reconnaissance activities. Portspoof is primarily used for network defense, honeypots, and deception-based security strategies.
Installation
섹션 제목: “Installation”Linux (Debian/Ubuntu)
섹션 제목: “Linux (Debian/Ubuntu)”sudo apt-get install portspoofFedora/RHEL
섹션 제목: “Fedora/RHEL”sudo dnf install portspoofmacOS (via Homebrew)
섹션 제목: “macOS (via Homebrew)”brew install portspoofBuild from Source
섹션 제목: “Build from Source”git clone https://github.com/drk1wi/portspoof.git
cd portspoof
./configure
make
sudo make installInstall Build Dependencies
섹션 제목: “Install Build Dependencies”sudo apt-get install build-essential autoconf automake libtoolVerify Installation
섹션 제목: “Verify Installation”portspoof --version
portspoof --helpCore Concepts
섹션 제목: “Core Concepts”Service Emulation
섹션 제목: “Service Emulation”Portspoof emulates legitimate service responses to appear as if real services are running.
Port Mapping
섹션 제목: “Port Mapping”Map arbitrary ports to service signatures, creating convincing decoy services.
Signature Database
섹션 제목: “Signature Database”Includes extensive database of authentic service banners and responses.
Network Deception
섹션 제목: “Network Deception”Confuse attackers and automated scanning tools by presenting false service information.
Configuration
섹션 제목: “Configuration”Main Configuration File
섹션 제목: “Main Configuration File”/etc/portspoof/portspoof.conf
/usr/local/etc/portspoof.confService Signatures Database
섹션 제목: “Service Signatures Database”/usr/share/portspoof/portspoof_signatures
/etc/portspoof/portspoof_signaturesView Default Configuration
섹션 제목: “View Default Configuration”cat /etc/portspoof/portspoof.confBasic Commands
섹션 제목: “Basic Commands”Start Portspoof
섹션 제목: “Start Portspoof”sudo portspoof
sudo portspoof -c /etc/portspoof/portspoof.confStart on Specific Port
섹션 제목: “Start on Specific Port”sudo portspoof -p 8888Run in Foreground (Debug)
섹션 제목: “Run in Foreground (Debug)”sudo portspoof -dSpecify Configuration File
섹션 제목: “Specify Configuration File”sudo portspoof -c /custom/path/portspoof.confStart with Specific Signature Database
섹션 제목: “Start with Specific Signature Database”sudo portspoof -s /path/to/signaturesCommon Usage Patterns
섹션 제목: “Common Usage Patterns”| Command | Description |
|---|---|
sudo portspoof | Start with default configuration |
sudo portspoof -p 9999 | Run on custom port |
sudo portspoof -d | Debug mode (foreground) |
sudo portspoof -c config.conf | Use custom config |
sudo portspoof -s signatures.txt | Load custom signatures |
sudo portspoof -l 192.168.1.100 | Bind to specific interface |
Configuration File Setup
섹션 제목: “Configuration File Setup”Basic Configuration Template
섹션 제목: “Basic Configuration Template”# Portspoof Configuration File
#
# Server settings
SERVER_PORT=9999
SERVER_BIND_ADDR=0.0.0.0
SERVER_LISTEN_QUEUE=500
# Service signature database
SIGNATURES_FILE=/usr/share/portspoof/portspoof_signatures
# Logging
LOG_FILE=/var/log/portspoof/portspoof.log
VERBOSITY_LEVEL=1
# Performance
MAX_THREADS=100
INITIAL_THREADS=10Custom Port Configuration
섹션 제목: “Custom Port Configuration”SERVER_PORT=8888
SERVER_BIND_ADDR=192.168.1.100
SIGNATURES_FILE=/etc/portspoof/custom_signaturesHigh-Volume Configuration
섹션 제목: “High-Volume Configuration”SERVER_PORT=9999
MAX_THREADS=500
INITIAL_THREADS=50
SERVER_LISTEN_QUEUE=1000Service Signatures
섹션 제목: “Service Signatures”View Available Signatures
섹션 제목: “View Available Signatures”cat /usr/share/portspoof/portspoof_signatures | head -20HTTP Service Signature
섹션 제목: “HTTP Service Signature”HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 1234
Server: Apache/2.4.41
<html><head><title>Index of /</title></head><body>
<h1>Index of /</h1>
...
</body></html>SSH Service Signature
섹션 제목: “SSH Service Signature”SSH-2.0-OpenSSH_7.4SMTP Service Signature
섹션 제목: “SMTP Service Signature”220 mail.example.com ESMTP PostfixFTP Service Signature
섹션 제목: “FTP Service Signature”220 FTP Server ReadyTelnet Response
섹션 제목: “Telnet Response”Connected to server
login:Create Custom Signatures
섹션 제목: “Create Custom Signatures”cat > custom_signatures.txt << 'EOF'
# Port 80 HTTP
"GET / HTTP/1.1" "HTTP/1.1 200 OK\r\nServer: Apache/2.4.41\r\n\r\n"
# Port 22 SSH
"SSH-2.0" "SSH-2.0-OpenSSH_7.4\r\n"
# Port 25 SMTP
"EHLO\|HELO" "220 mail.example.com ESMTP Postfix\r\n"
# Port 3389 RDP
".*" "\x03\x00\x00\x13\x0e\xe0\x00\x00\x00\x00\x00\x01\x00\x08\x00\x03\x00\x00\x00"
# Port 445 SMB
".*" "\xff\x53\x4d\x42"
EOFNetwork Deception Strategies
섹션 제목: “Network Deception Strategies”Honeypot Port Setup
섹션 제목: “Honeypot Port Setup”# Configure portspoof to emulate multiple services
sudo portspoof -c honeypot.conf
# Monitor connections
tail -f /var/log/portspoof/portspoof.logDecoy Network Service
섹션 제목: “Decoy Network Service”# Emulate multiple services on single port
sudo portspoof -p 9999 -s decoy_signatures.txtPort Obfuscation
섹션 제목: “Port Obfuscation”# Make all ports appear to have services
# Map every connection to realistic service responsesAdvanced Deployment
섹션 제목: “Advanced Deployment”Multi-Interface Binding
섹션 제목: “Multi-Interface Binding”# Create config for multiple interfaces
cat > multi_interface.conf << 'EOF'
SERVER_PORT=9999
SERVER_BIND_ADDR=0.0.0.0
SIGNATURES_FILE=/usr/share/portspoof/portspoof_signatures
EOF
sudo portspoof -c multi_interface.confLoad Balancing Setup
섹션 제목: “Load Balancing Setup”# Run multiple portspoof instances
sudo portspoof -p 9999 &
sudo portspoof -p 9998 &
sudo portspoof -p 9997 &Systemd Service Configuration
섹션 제목: “Systemd Service Configuration”cat > /etc/systemd/system/portspoof.service << 'EOF'
[Unit]
Description=Portspoof Service Emulation
After=network.target
[Service]
Type=simple
User=root
ExecStart=/usr/bin/portspoof -c /etc/portspoof/portspoof.conf
Restart=on-failure
RestartSec=10
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl enable portspoof
sudo systemctl start portspoofTesting Portspoof Responses
섹션 제목: “Testing Portspoof Responses”Test Connection
섹션 제목: “Test Connection”nc -zv localhost 9999
nc -zv 192.168.1.100 9999Capture Service Banner
섹션 제목: “Capture Service Banner”echo "" | nc 192.168.1.100 9999
timeout 2 nc 192.168.1.100 9999 | od -cVerify HTTP Response
섹션 제목: “Verify HTTP Response”curl -v http://127.0.0.1:9999/Test SSH Response
섹션 제목: “Test SSH Response”ssh -v localhost -p 9999Nmap Service Detection
섹션 제목: “Nmap Service Detection”nmap -sV 127.0.0.1 -p 9999
nmap -sV -A 192.168.1.100 -p 9999Zenmap Fingerprinting
섹션 제목: “Zenmap Fingerprinting”# Test against Zenmap/Nmap OS detection
nmap -O 127.0.0.1 -p 9999Monitoring and Logging
섹션 제목: “Monitoring and Logging”View Portspoof Logs
섹션 제목: “View Portspoof Logs”tail -f /var/log/portspoof/portspoof.log
grep "connection" /var/log/portspoof/portspoof.logMonitor Active Connections
섹션 제목: “Monitor Active Connections”sudo netstat -antp | grep portspoof
sudo lsof -i :9999Real-time Connection Tracking
섹션 제목: “Real-time Connection Tracking”watch -n 1 "netstat -antp | grep portspoof"Parse Connection Attempts
섹션 제목: “Parse Connection Attempts”grep "from" /var/log/portspoof/portspoof.log | \
awk '{print $NF}' | sort | uniq -c | sort -rnHoneypot Integration
섹션 제목: “Honeypot Integration”Combine with IDS
섹션 제목: “Combine with IDS”# Log portspoof connections
tail -f /var/log/portspoof/portspoof.log | \
while read line; do
# Alert on suspicious IPs
echo "$line" | grep -i attack >> suspicious.log
doneNetwork Tapering
섹션 제목: “Network Tapering”# Use portspoof to confuse network scans
# Deploy on decoy systems
# Monitor all connection attemptsCreate Honeypot Network
섹션 제목: “Create Honeypot Network”# Isolated network segment with portspoof
# Running on multiple ports
# Monitoring all trafficPerformance Tuning
섹션 제목: “Performance Tuning”Optimize for High Load
섹션 제목: “Optimize for High Load”cat > high_load.conf << 'EOF'
MAX_THREADS=1000
INITIAL_THREADS=100
SERVER_LISTEN_QUEUE=5000
TIMEOUT=30
EOF
sudo portspoof -c high_load.confResource Limits
섹션 제목: “Resource Limits”ulimit -n 10000
ulimit -u 1000Process Monitoring
섹션 제목: “Process Monitoring”ps aux | grep portspoof
top -p $(pgrep portspoof)Troubleshooting
섹션 제목: “Troubleshooting”Permission Denied (Port < 1024)
섹션 제목: “Permission Denied (Port < 1024)”# Use sudo for ports below 1024
sudo portspoof -p 80
# Or run as root
su - -c "portspoof -p 80"Port Already in Use
섹션 제목: “Port Already in Use”# Check existing bindings
sudo netstat -tlnp | grep :9999
# Kill existing process
sudo kill $(lsof -t -i :9999)Configuration File Not Found
섹션 제목: “Configuration File Not Found”# Verify file exists and permissions
ls -la /etc/portspoof/portspoof.conf
cat /etc/portspoof/portspoof.confSignature File Issues
섹션 제목: “Signature File Issues”# Check signature file
ls -la /usr/share/portspoof/portspoof_signatures
file /usr/share/portspoof/portspoof_signaturesService Not Starting
섹션 제목: “Service Not Starting”# Run in debug mode
sudo portspoof -d
# Check for errors
sudo systemctl status portspoof
sudo journalctl -u portspoof -n 20Security Considerations
섹션 제목: “Security Considerations”Network Placement
섹션 제목: “Network Placement”- Deploy on internal networks only
- Ensure controlled environment
- Document deception strategy
- Monitor for false positives
Ethical Usage
섹션 제목: “Ethical Usage”- Use only in authorized networks
- Document deception policies
- Ensure team awareness
- Legal compliance verification
Detection and Analysis
섹션 제목: “Detection and Analysis”# Monitor portspoof system
watch -n 5 "netstat -antp | grep portspoof"
tail -f /var/log/portspoof/portspoof.log | grep -v "^$"Advanced Scenarios
섹션 제목: “Advanced Scenarios”Multi-Service Honeypot
섹션 제목: “Multi-Service Honeypot”# Emulate multiple services on different ports
sudo portspoof -p 80 -s http_signatures &
sudo portspoof -p 22 -s ssh_signatures &
sudo portspoof -p 25 -s smtp_signatures &
sudo portspoof -p 3306 -s mysql_signatures &Incident Response Preparation
섹션 제목: “Incident Response Preparation”# Setup decoy environment
# Monitor attacker interaction
# Collect forensic evidence
# Analyze attack patternsThreat Intelligence Gathering
섹션 제목: “Threat Intelligence Gathering”# Deploy honeypot
# Record all connection attempts
# Analyze attacker behavior
# Share findings with communityBest Practices
섹션 제목: “Best Practices”- Clear Documentation: Document deception strategy
- Regular Updates: Keep signature database current
- Monitoring: Actively monitor honeypot
- Isolation: Properly segment honeypot network
- Incident Response: Have plan for detected attacks
- Legal Review: Verify compliance with regulations
- Team Coordination: Ensure all team members aware
- Log Retention: Archive connection logs
Related Tools
섹션 제목: “Related Tools”- Honeyd: Virtual honeypot framework
- Cowrie: SSH/Telnet honeypot
- Kippo: Medium interaction honeypot
- Dionaea: Low interaction honeypot
- Snare/Tanner: Web application honeypot
- Suricata: Network security monitoring
- Zeek: Network analysis framework