@hadi_ali/warden 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/app/honeypot.js +229 -6
- package/package.json +1 -1
package/app/honeypot.js
CHANGED
|
@@ -1,26 +1,249 @@
|
|
|
1
1
|
function checkHoneypot(req) {
|
|
2
|
+
// Honeypot paths commonly probed by scanners, bots, and exploit kits.
|
|
3
|
+
// Matching: exact segment match OR any path segment equals one of these.
|
|
2
4
|
const honeypots = [
|
|
5
|
+
// ---------- WordPress ----------
|
|
3
6
|
'wp-admin', 'wp-login.php', 'wp-config.php',
|
|
4
|
-
'
|
|
5
|
-
'
|
|
6
|
-
'
|
|
7
|
-
'
|
|
8
|
-
'
|
|
7
|
+
'wp-config.php.bak', 'wp-config.php.old', 'wp-config.php.save',
|
|
8
|
+
'wp-config.php.txt', 'wp-config.php.orig', 'wp-config.php.swp',
|
|
9
|
+
'wp-config.bak', 'wp-config.old', 'wp-config.txt', 'wp-config-sample.php',
|
|
10
|
+
'wp-content', 'wp-content/plugins', 'wp-content/themes', 'wp-content/uploads',
|
|
11
|
+
'wp-includes', 'wp-json', 'wp-cron.php', 'wp-comments-post.php',
|
|
12
|
+
'xmlrpc.php', 'wp-signup.php', 'wp-register.php',
|
|
13
|
+
'wp-admin/admin-ajax.php', 'wp-admin/install.php',
|
|
14
|
+
'wp-admin/setup-config.php', 'wp-admin/includes', 'wp-admin/maint',
|
|
15
|
+
'wordpress', 'wp', 'blog', 'wp-trackback.php',
|
|
16
|
+
|
|
17
|
+
// ---------- Other CMS ----------
|
|
18
|
+
'joomla', 'joomla/administrator', 'administrator',
|
|
19
|
+
'drupal', 'drupal/admin', 'sites/default',
|
|
20
|
+
'magento', 'magento/admin', 'magento2',
|
|
21
|
+
'typo3', 'concrete5', 'cms', 'cms/admin',
|
|
22
|
+
'bitrix', 'bitrix/admin', 'opencart', 'prestashop',
|
|
23
|
+
'shopify', 'squarespace', 'wix', 'ghost',
|
|
24
|
+
|
|
25
|
+
// ---------- Database admin tools ----------
|
|
26
|
+
'phpmyadmin', 'phpmyadmin2', 'phpmyadmin3', 'phpmyadmin4',
|
|
27
|
+
'phpmyadmin5', 'pma', 'pma2', 'myadmin', 'myadmin2', 'myadmin3',
|
|
28
|
+
'adminer', 'adminer.php', 'adminer-4.8.1', 'adminer-4.7.8',
|
|
29
|
+
'phpminiadmin.php', 'sql.php', 'mysql.php', 'database.php',
|
|
30
|
+
'pgadmin', 'pgadmin4', 'phppgadmin', 'mysqladmin',
|
|
31
|
+
'redis-commander', 'redisinsight', 'redis-desktop',
|
|
32
|
+
'rockmongo', 'mongo-express', 'mongo', 'mongosh',
|
|
33
|
+
'arangodb', 'neo4j', 'memcached', 'memcached-admin',
|
|
34
|
+
'couchdb', 'couchdb-utils', 'elasticsearch',
|
|
35
|
+
|
|
36
|
+
// ---------- Server admin panels ----------
|
|
37
|
+
'admin', 'administrator', 'panel', 'control', 'controlpanel',
|
|
38
|
+
'cpanel', 'whm', 'plesk', 'webmin', 'virtualmin',
|
|
39
|
+
'directadmin', 'ispconfig', 'vesta', 'vestacp',
|
|
40
|
+
'manage', 'manager', 'portal', 'dashboard', 'dashboards',
|
|
41
|
+
'backend', 'backoffice', 'cms-admin', 'site-admin',
|
|
42
|
+
'useradmin', 'user-admin', 'sysadmin', 'sys-admin',
|
|
43
|
+
|
|
44
|
+
// ---------- Server status / info (often leak data) ----------
|
|
45
|
+
'server-status', 'server-info', 'server-status?',
|
|
46
|
+
'nginx_status', 'apache-status', 'apache-status?',
|
|
47
|
+
'status', 'status/', 'status.json', 'status.xml', 'status.php',
|
|
48
|
+
'info', 'info.php', 'info.html', 'info.txt',
|
|
49
|
+
'phpinfo', 'phpinfo.php', 'php_info', 'php-version',
|
|
50
|
+
'test', 'test.php', 'test.html', 'test.txt',
|
|
51
|
+
'demo', 'demo.php', 'sample', 'sample.php', 'example.php',
|
|
52
|
+
'health', 'healthcheck', 'health.php', 'health.json',
|
|
53
|
+
'ping', 'ping.php', 'ping.json', 'probe', 'probe.json',
|
|
54
|
+
'version', 'version.php', 'version.json', 'version.txt',
|
|
55
|
+
'about', 'about.php', 'about.json', 'about.html',
|
|
56
|
+
|
|
57
|
+
// ---------- Shell / Webshell / RCE attempts ----------
|
|
58
|
+
'shell.php', 'shell.asp', 'shell.aspx', 'shell.jsp', 'shell.cgi',
|
|
59
|
+
'cmd.php', 'cmd.asp', 'cmd.aspx', 'cmd.jsp', 'cmd.cgi',
|
|
60
|
+
'exec.php', 'exec.asp', 'exec.aspx', 'backdoor', 'backdoor.php',
|
|
61
|
+
'webshell', 'webshell.php', 'webshell.jsp', 'webshell.aspx',
|
|
62
|
+
'c99.php', 'c99.txt', 'c99shell', 'c99madshell',
|
|
63
|
+
'r57.php', 'r57.txt', 'r57shell',
|
|
64
|
+
'wso.php', 'wso.txt', 'wso2.php', 'wso2.txt',
|
|
65
|
+
'alfa.php', 'alfa.txt', 'alfacompact.php',
|
|
66
|
+
'b374k.php', 'b374k.txt', 'b374k-2.2.php',
|
|
67
|
+
'mini.php', 'minishell.php', 'simshell.php', 'phpspy.php',
|
|
68
|
+
'eval.php', 'system.php', 'passthru.php', 'popen.php',
|
|
69
|
+
'reverse-shell.php', 'revshell.php', 'nc.exe', 'nc.php',
|
|
70
|
+
'cmd-aspx', 'shell.aspx', '1.asp', 'x.asp', '0.asp',
|
|
71
|
+
'c99', 'r57', 'wso', 'alfa',
|
|
72
|
+
|
|
73
|
+
// ---------- Environment & config files (CRITICAL — leak secrets) ----------
|
|
74
|
+
'env', '.env', 'env.bak', 'env.old', 'env.save', 'env.orig',
|
|
75
|
+
'.env.bak', '.env.old', '.env.save', '.env.orig', '.env.swp',
|
|
76
|
+
'.env.local', '.env.production', '.env.development',
|
|
77
|
+
'.env.staging', '.env.testing', '.env.example', '.env.sample',
|
|
78
|
+
'.env.backup', '.env.dist', '.env.defaults',
|
|
79
|
+
'env.local', 'env.production', 'env.development',
|
|
80
|
+
'env.staging', 'env.testing', 'env.example',
|
|
81
|
+
'htaccess', 'htpasswd', '.htaccess', '.htpasswd',
|
|
82
|
+
'htaccess.bak', '.htaccess.bak',
|
|
83
|
+
'user.ini', '.user.ini', 'php.ini', 'php.ini.bak',
|
|
84
|
+
'web.config', 'web.config.bak', 'web.config.old',
|
|
85
|
+
'config.php', 'config.php.bak', 'config.php.old', 'config.php.save',
|
|
86
|
+
'configuration.php', 'local.xml', 'app/etc/local.xml',
|
|
87
|
+
'config.yml', 'config.yaml', 'config.yml.bak',
|
|
88
|
+
'config.json', 'config.json.bak',
|
|
89
|
+
'config.xml', 'config.xml.bak',
|
|
90
|
+
'config.ini', 'config.ini.bak',
|
|
91
|
+
'config.inc.php', 'config.inc', 'settings.php', 'settings.py',
|
|
92
|
+
'settings.json', 'settings.yml', 'settings.yaml',
|
|
93
|
+
'app.config', 'application.config', 'app.yml', 'application.yml',
|
|
94
|
+
'artisan', // Laravel
|
|
95
|
+
'database.yml', 'database.yaml', 'database.php',
|
|
96
|
+
'secrets.yml', 'secrets.yaml', 'secrets.json',
|
|
97
|
+
'credentials.yml', 'credentials.yaml', 'credentials.json',
|
|
98
|
+
'production.yml', 'production.yaml',
|
|
99
|
+
'staging.yml', 'staging.yaml',
|
|
100
|
+
|
|
101
|
+
// ---------- Version control ----------
|
|
102
|
+
'git', '.git', '.git/HEAD', '.git/config', '.git/index',
|
|
103
|
+
'.gitignore', '.gitattributes', '.gitmodules',
|
|
104
|
+
'.git/objects', '.git/refs', '.git/logs', '.git/hooks',
|
|
105
|
+
'.git/packed-refs', '.git/info', '.git/info/refs',
|
|
106
|
+
'svn', '.svn', '.svn/entries', '.svn/wc.db', '.svn/all-wcprops',
|
|
107
|
+
'hg', '.hg', '.hg/store', '.hg/requires', '.hg/dirstate',
|
|
108
|
+
'bzr', '.bzr', '.bzr/README',
|
|
109
|
+
|
|
110
|
+
// ---------- Cloud / Container secrets ----------
|
|
111
|
+
'.dockerignore', 'dockerfile', 'dockerfile.bak',
|
|
112
|
+
'docker-compose.yml', 'docker-compose.yaml',
|
|
113
|
+
'docker-compose.override.yml',
|
|
114
|
+
'.docker', 'docker.sock',
|
|
115
|
+
'.aws', '.aws/credentials', '.aws/config',
|
|
116
|
+
'.kube', '.kube/config', 'kubeconfig',
|
|
117
|
+
'.ssh', '.ssh/id_rsa', '.ssh/id_rsa.pub',
|
|
118
|
+
'.ssh/authorized_keys', '.ssh/known_hosts',
|
|
119
|
+
'.ssh/config', 'id_rsa', 'id_rsa.pub', 'id_dsa', 'id_dsa.pub',
|
|
120
|
+
'id_ecdsa', 'id_ecdsa.pub', 'id_ed25519', 'id_ed25519.pub',
|
|
121
|
+
'ssh_keys', 'ssh-keys', 'sshkey', 'ssh-key',
|
|
122
|
+
'.bash_history', '.zsh_history', '.mysql_history',
|
|
123
|
+
'.psql_history', '.python_history',
|
|
124
|
+
'gcp-credentials.json', 'service-account.json',
|
|
125
|
+
'firebase-adminsdk.json', 'gcloud-service-key.json',
|
|
126
|
+
|
|
127
|
+
// ---------- CI/CD ----------
|
|
128
|
+
'.gitlab-ci.yml', '.github', '.github/workflows',
|
|
129
|
+
'jenkinsfile', 'jenkins', 'jenkins/',
|
|
130
|
+
'.travis.yml', '.circleci', 'circle.yml',
|
|
131
|
+
'bitbucket-pipelines.yml', '.drone.yml', '.drone.yml.sig',
|
|
132
|
+
'azure-pipelines.yml', '.appveyor.yml',
|
|
133
|
+
'codefresh.yml', 'wercker.yml', 'shippable.yml',
|
|
134
|
+
|
|
135
|
+
// ---------- Backup files (CRITICAL — often full site dumps) ----------
|
|
136
|
+
'backup', 'backups', 'backup.zip', 'backup.tar.gz', 'backup.tar',
|
|
137
|
+
'backup.tgz', 'backup.tar.bz2', 'backup.7z', 'backup.rar',
|
|
138
|
+
'backup.sql', 'backup.bak', 'backup.db', 'backup.json',
|
|
139
|
+
'backup.xml', 'backup.csv', 'backup.log',
|
|
140
|
+
'backup.old', 'backup.save', 'backup.orig',
|
|
141
|
+
'site.zip', 'site.tar.gz', 'site.tar', 'site.tgz',
|
|
142
|
+
'www.zip', 'www.tar.gz', 'www.tar', 'www.tgz',
|
|
143
|
+
'public.zip', 'html.zip', 'web.zip',
|
|
144
|
+
'app.zip', 'app.tar.gz', 'src.zip', 'code.zip',
|
|
145
|
+
'dump.sql', 'database.sql', 'db.sql', 'db_backup.sql',
|
|
146
|
+
'mysql.sql', 'postgres.sql', 'postgresql.sql',
|
|
147
|
+
'data.sql', 'users.sql', 'members.sql', 'accounts.sql',
|
|
148
|
+
'1.sql', 'dump', 'snapshot', 'full_backup', 'backup_db',
|
|
149
|
+
'bak', 'bak/', 'old', 'old/', 'archives', 'archive.zip',
|
|
150
|
+
'sql', 'sql/', 'database', 'databases',
|
|
151
|
+
|
|
152
|
+
// ---------- Logs ----------
|
|
153
|
+
'log', 'logs', 'logging', 'log/',
|
|
154
|
+
'access.log', 'error.log', 'app.log', 'httpd.log',
|
|
155
|
+
'nginx.log', 'debug.log', 'errors.log',
|
|
156
|
+
'application.log', 'laravel.log', 'storage/logs',
|
|
157
|
+
'storage/logs/laravel.log', 'log.txt', 'logs.txt',
|
|
158
|
+
'debug.txt', 'errors.txt',
|
|
159
|
+
|
|
160
|
+
// ---------- API docs / debug endpoints ----------
|
|
161
|
+
'swagger', 'swagger.json', 'swagger.yaml', 'swagger.yml',
|
|
162
|
+
'swagger/v1/swagger.json', 'swagger/v2/swagger.json',
|
|
163
|
+
'api-docs', 'api-docs.json', 'api-docs.yaml',
|
|
164
|
+
'openapi', 'openapi.json', 'openapi.yaml', 'openapi.yml',
|
|
165
|
+
'redoc', 'redoc.html', 'swagger-ui', 'swagger-ui.html',
|
|
166
|
+
'graphql', 'graphiql', 'graphql-playground', 'playground',
|
|
167
|
+
'graph', 'gql', 'voyager', 'altair',
|
|
168
|
+
'rpc', 'soap', 'wsdl', 'wsdl.php',
|
|
169
|
+
'actuator', 'actuator/', 'actuator/env', 'actuator/health',
|
|
170
|
+
'actuator/beans', 'actuator/mappings', 'actuator/configprops',
|
|
171
|
+
|
|
172
|
+
// ---------- Installer / setup ----------
|
|
173
|
+
'install.php', 'install/', 'install', 'install.html',
|
|
174
|
+
'setup.php', 'setup/', 'setup', 'setup.html',
|
|
175
|
+
'init.php', 'initialize.php', 'migrate.php', 'upgrade.php',
|
|
176
|
+
'upgrade/', 'update.php', 'updater.php',
|
|
177
|
+
'installer', 'installer.php', 'installwizard.php',
|
|
178
|
+
|
|
179
|
+
// ---------- Common probes ----------
|
|
180
|
+
'crossdomain.xml', 'sitemap.xml', 'humans.txt',
|
|
181
|
+
'security.txt', '.well-known/security.txt',
|
|
182
|
+
'readme.html', 'readme.txt', 'readme.md', 'readme',
|
|
183
|
+
'changelog.txt', 'release-notes.txt', 'changelog.md',
|
|
184
|
+
'license.txt', 'license.md', 'license',
|
|
185
|
+
'robots.txt', 'ads.txt', 'app-ads.txt', 'favicon.ico',
|
|
186
|
+
'manifest.json', 'service-worker.js', 'sw.js',
|
|
187
|
+
'package.json', 'composer.json', 'composer.lock',
|
|
188
|
+
'package-lock.json', 'yarn.lock',
|
|
189
|
+
|
|
190
|
+
// ---------- Suspicious paths / files ----------
|
|
191
|
+
'internal', 'private', 'secret', 'hidden',
|
|
192
|
+
'restricted', 'confidential', 'topsecret',
|
|
193
|
+
'staging', 'preview', 'preprod', 'pre-prod',
|
|
194
|
+
'dev', 'development', 'test', 'testing', 'qa', 'uat', 'sandbox',
|
|
195
|
+
'mock', 'fake', 'dummy', 'temp', 'tmp',
|
|
196
|
+
'upload', 'uploads', 'uploaded', 'files', 'documents',
|
|
197
|
+
'wp-content/uploads', 'media', 'media/uploads',
|
|
9
198
|
];
|
|
10
199
|
|
|
11
|
-
|
|
200
|
+
// Dangerous file extensions — any file ending in these triggers the honeypot.
|
|
201
|
+
const dangerousExtensions = new Set([
|
|
202
|
+
// Backup / old
|
|
203
|
+
'bak', 'old', 'orig', 'copy', 'save', 'swp', 'swo', 'tmp', 'temp',
|
|
204
|
+
'bk', 'bkp', 'backup', '1', '2', '3', // .1, .2 versions
|
|
205
|
+
// Database
|
|
206
|
+
'sql', 'db', 'sqlite', 'sqlite3', 'mdb', 'accdb',
|
|
207
|
+
'dbf', 'frm', 'myd', 'myi', // MySQL files
|
|
208
|
+
// Secrets / keys
|
|
209
|
+
'key', 'pem', 'crt', 'cer', 'pfx', 'p12', 'p8',
|
|
210
|
+
'keystore', 'jks', 'asc', 'gpg', 'pub',
|
|
211
|
+
// Archives
|
|
212
|
+
'zip', 'tar', 'tgz', 'tar.gz', 'gz', 'bz2', 'xz', '7z', 'rar',
|
|
213
|
+
'iso', 'dmg', 'jar', 'war', 'ear',
|
|
214
|
+
// Logs
|
|
215
|
+
'log', 'logs',
|
|
216
|
+
// Config / env
|
|
217
|
+
'config', 'conf', 'cfg', 'ini', 'env',
|
|
218
|
+
// VCS
|
|
219
|
+
'git', 'svn', 'hg',
|
|
220
|
+
// Source / code (might leak unreleased code)
|
|
221
|
+
'php', 'php5', 'php7', 'phtml', 'phar',
|
|
222
|
+
'pl', 'py', 'rb', 'sh', 'bash',
|
|
223
|
+
]);
|
|
12
224
|
|
|
225
|
+
const path = (req.path || '').toLowerCase().replace(/\/+$/, '');
|
|
226
|
+
|
|
227
|
+
// Exact path match
|
|
13
228
|
for (const honeypot of honeypots) {
|
|
14
229
|
if (path === `/${honeypot}` || path === honeypot) {
|
|
15
230
|
return 30;
|
|
16
231
|
}
|
|
17
232
|
}
|
|
18
233
|
|
|
234
|
+
// Segment match (e.g., /something/wp-admin/foo matches because 'wp-admin' is a segment)
|
|
19
235
|
const pathSegments = path.split('/').filter(Boolean);
|
|
20
236
|
for (const segment of pathSegments) {
|
|
21
237
|
if (honeypots.includes(segment)) {
|
|
22
238
|
return 30;
|
|
23
239
|
}
|
|
240
|
+
// Match dangerous file extensions (e.g., config.bak, db.sql, backup.zip)
|
|
241
|
+
if (segment.includes('.')) {
|
|
242
|
+
const ext = segment.split('.').pop();
|
|
243
|
+
if (dangerousExtensions.has(ext)) {
|
|
244
|
+
return 30;
|
|
245
|
+
}
|
|
246
|
+
}
|
|
24
247
|
}
|
|
25
248
|
|
|
26
249
|
return 0;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hadi_ali/warden",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.1",
|
|
4
4
|
"description": "Express middleware that scores requests and blocks bots/scrapers using header heuristics, IP reputation, rate limiting, and brute-force tracking.",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"scripts": {
|