npm - honeyweb-core - Versions diffs - 1.0.3 → 2.0.2 - Mend

honeyweb-core 1.0.3 → 2.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (28) hide show

package/ai/gemini.js +52 -0
package/ai/index.js +49 -0
package/ai/prompt-templates.js +64 -0
package/config/defaults.js +79 -0
package/config/index.js +86 -0
package/config/schema.js +72 -0
package/detection/behavioral.js +186 -0
package/detection/bot-detector.js +140 -0
package/detection/index.js +136 -0
package/detection/patterns.js +83 -0
package/detection/rate-limiter.js +109 -0
package/detection/whitelist.js +116 -0
package/index.js +60 -204
package/middleware/blocklist-checker.js +34 -0
package/middleware/dashboard.js +277 -0
package/middleware/index.js +73 -0
package/middleware/request-analyzer.js +125 -0
package/middleware/trap-injector.js +52 -0
package/package.json +27 -18
package/storage/bot-tracker.js +109 -0
package/storage/index.js +25 -0
package/storage/json-store.js +206 -0
package/storage/memory-store.js +128 -0
package/utils/cache.js +106 -0
package/utils/dns-verify.js +95 -0
package/utils/event-emitter.js +65 -0
package/utils/logger.js +88 -0
package/blocked-ips.json +0 -0

package/index.js CHANGED Viewed

@@ -1,208 +1,64 @@
-// honeyweb-core/index.js (V2 - Full Suite)
-const fs = require('fs-extra');
-const path = require('path');
-const cheerio = require('cheerio');
-const { GoogleGenerativeAI } = require("@google/generative-ai");
-const DB_FILE = path.join(__dirname, 'blocked-ips.json');
-// ------------------------------------------------------
-// 1. CONFIGURATION
-// ------------------------------------------------------
-const GOOGLE_API_KEY = process.env.HONEYWEB_API_KEY;
-if (!GOOGLE_API_KEY) {
-    console.error("⚠️ [HoneyWeb] Error: HONEYWEB_API_KEY is missing from environment variables.");
-}
-const TRAP_PATHS = ['/admin-backup-v2', '/wp-login-hidden', '/db-dump-2024', '/auth/root-access'];
-// Brute Force Config
-const RATE_LIMIT_WINDOW = 10000; // 10s
-const MAX_REQUESTS = 50;
-const trafficMap = new Map();
-// NEW: SQL Injection & XSS Patterns (The WAF)
-const MALICIOUS_PATTERNS = [
-    /(\%27)|(\')|(\-\-)|(\%23)|(#)/i,       // SQLi: ' -- #
-    /((\%3D)|(=))[^\n]*((\%27)|(\')|(\-\-)|(\%3B)|(;))/i, // SQLi: = ' ;
-    /\w*((\%27)|(\'))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/i, // SQLi: ' OR
-    /(<script>)/i,                          // XSS
-    /(alert\()/i                            // XSS
-];
-// Ensure DB exists
-if (!fs.existsSync(DB_FILE)) { fs.writeJsonSync(DB_FILE, []); }
-// ------------------------------------------------------
-// 2. AI INTELLIGENCE
-// ------------------------------------------------------
-async function generateThreatReport(ip, userAgent, type, details) {
-    if (!GOOGLE_API_KEY || GOOGLE_API_KEY.includes('YOUR_KEY')) return;
-    console.log(`🤖 [HoneyWeb] Asking Gemini to analyze: ${type}...`);
-    try {
-        const genAI = new GoogleGenerativeAI(GOOGLE_API_KEY);
-        const model = genAI.getGenerativeModel({ model: "gemini-2.5-flash" });
-        const prompt = `Cybersecurity Alert. Analyze this blocked attack.
-            Type: ${type} | IP: ${ip} | UA: ${userAgent} | Detail: ${details}
-            Respond in 1 sentence: What is the attacker trying to exploit?`;
-        const result = await model.generateContent(prompt);
-        console.log("\n📝 [HoneyWeb INTELLIGENCE REPORT]");
-        console.log("---------------------------------------------------");
-        console.log(result.response.text().trim());
-        console.log("---------------------------------------------------\n");
-    } catch (e) { console.error("❌ Gemini Error:", e.message); }
-}
-// ------------------------------------------------------
-// 3. HELPER: BAN SYSTEM
-// ------------------------------------------------------
-async function banIP(ip, reason) {
-    let list = [];
-    try { list = await fs.readJson(DB_FILE); } catch (e) {}
-    // Check if IP is already in the list (simple check)
-    const exists = list.some(entry => entry.ip === ip);
-    if (!exists) {
-        list.push({ ip, reason, date: new Date().toISOString() });
-        await fs.writeJson(DB_FILE, list);
-        console.log(`🚫 [HoneyWeb] BANNED IP: ${ip} | Reason: ${reason}`);
-        return true;
-    }
-    return false;
-}
-// ------------------------------------------------------
-// 4. MAIN MIDDLEWARE
-// ------------------------------------------------------
-function honeyWeb() {
-    return async (req, res, next) => {
-        const clientIP = req.ip || req.connection.remoteAddress;
-        const userAgent = req.headers['user-agent'] || 'Unknown';
-        // A. STATUS DASHBOARD
-        if (req.path === '/honeyweb-status') {
-            // Insert your own secret key here
-            // Usage: http://localhost:3000/honeyweb-status?key=admin123
-            if (req.query.key !== 'admin123') {
-                return res.status(404).send('Not Found'); // Pretend it doesn't exist
-            }
-            const list = await fs.readJson(DB_FILE);
-            return res.send(`
-                <html><body style="font-family:monospace; background:#222; color:#0f0; padding:20px;">
-                <h1>🛡️ HoneyWeb Active Defense Status</h1>
-                <p>Total Banned IPs: ${list.length}</p>
-                <table border="1" style="border-collapse:collapse; width:100%; color:#fff;">
-                <tr><th>IP</th><th>Reason</th><th>Time</th></tr>
-                ${list.map(i => `<tr><td>${i.ip}</td><td>${i.reason}</td><td>${i.date}</td></tr>`).join('')}
-                </table></body></html>
-            `);
-        }
-        // B. CHECK BLOCKLIST
-        let bannedList = [];
-        try { bannedList = await fs.readJson(DB_FILE); } catch (e) {}
-        if (bannedList.some(entry => entry.ip === clientIP)) {
-            return res.status(403).send('<h1>403 Forbidden</h1><p>Your IP is flagged by HoneyWeb.</p>');
-        }
-        // C. ANTI-BRUTE FORCE (Rate Limit)
-        const now = Date.now();
-        if (!trafficMap.has(clientIP)) trafficMap.set(clientIP, { count: 1, start: now });
-        else {
-            const data = trafficMap.get(clientIP);
-            if (now - data.start > RATE_LIMIT_WINDOW) trafficMap.set(clientIP, { count: 1, start: now });
-            else {
-                data.count++;
-                if (data.count > MAX_REQUESTS) {
-                    if (await banIP(clientIP, "Brute Force (Rate Limit Exceeded)")) {
-                        generateThreatReport(clientIP, userAgent, "Volumetric Attack", `> ${MAX_REQUESTS} reqs/10s`);
-                    }
-                    return res.status(429).send('Too Many Requests');
-                }
-            }
-        }
-        // D. BAIT PARAMETER ANALYSIS (Smarter WAF)
-        const checkPayload = (str) => {
-            if (!str) return false;
-            return MALICIOUS_PATTERNS.some(regex => regex.test(str));
-        };
-        // Scan URL Query Params (?id=1 OR 1=1)
-        if (checkPayload(req.originalUrl)) {
-             if (await banIP(clientIP, "Malicious URL Payload")) {
-                generateThreatReport(clientIP, userAgent, "Injection Attack", `Dirty URL: ${req.originalUrl}`);
-            }
-            return res.status(403).send('Forbidden');
-        }
-        // Scan specific "Login" fields only (Reduces false positives on other forms)
-        if (req.method === 'POST' && req.body) {
-            const riskyInputs = [req.body.username, req.body.password, req.body.search];
-            if (riskyInputs.some(input => checkPayload(input))) {
-                 if (await banIP(clientIP, "Malicious Form Data")) {
-                    generateThreatReport(clientIP, userAgent, "SQL Injection", `Payload in form: ${JSON.stringify(req.body)}`);
-                }
-                return res.status(403).send('Forbidden');
-            }
-        }
-        // E. HONEYPOT TRAP
-        if (TRAP_PATHS.includes(req.path)) {
-            if (await banIP(clientIP, "Trap Triggered")) {
-                generateThreatReport(clientIP, userAgent, "Reconnaissance", `Accessed trap: ${req.path}`);
-                // detect browser of attacker and other info (hardware?) for logging
-            }
-            return res.status(403).send('<h1>403 Forbidden</h1>');
-        }
+// honeyweb-core/index.js
+// HoneyWeb - Intelligent Honeypot Middleware
+// Main entry point - orchestrates all modules
+const { loadConfig } = require('./config');
+const { createStorage } = require('./storage');
+const BotTracker = require('./storage/bot-tracker');
+const DetectionEngine = require('./detection');
+const AIAnalyzer = require('./ai');
+const Logger = require('./utils/logger');
+const HoneyWebEvents = require('./utils/event-emitter');
+const createMiddleware = require('./middleware');
+/**
+ * HoneyWeb Middleware Factory
+ * @param {Object} userConfig - Optional configuration overrides
+ * @returns {Function} - Express middleware function with event emitter
+ */
+function honeyWeb(userConfig = {}) {
+    // 1. Load and merge configuration
+    const config = loadConfig(userConfig);
+    // 2. Initialize core components
+    const logger = new Logger(config.logging);
+    const events = new HoneyWebEvents();
+    const storage = createStorage(config.storage);
+    const botTracker = new BotTracker(); // Track legitimate bot visits
+    const detector = new DetectionEngine(config);
+    const aiAnalyzer = new AIAnalyzer(config.ai);
+    // 3. Create middleware
+    const middleware = createMiddleware(config, storage, botTracker, detector, aiAnalyzer, logger, events);
+    // 4. Attach event emitter and utilities to middleware function
+    middleware.on = events.on.bind(events);
+    middleware.once = events.once.bind(events);
+    middleware.off = events.off.bind(events);
+    middleware.events = events;
+    middleware.storage = storage;
+    middleware.botTracker = botTracker;
+    middleware.detector = detector;
+    middleware.logger = logger;
+    middleware.config = config;
+    // 5. Cleanup on process exit
+    const cleanup = () => {
+        detector.destroy();
+        storage.destroy();
+    };
+    process.once('SIGINT', cleanup);
+    process.once('SIGTERM', cleanup);
-        // F. INJECTION
-        const originalSend = res.send;
-        res.send = function (body) {
-            if (typeof body === 'string' && (body.includes('<body') || body.includes('<html'))) {
-                const $ = cheerio.load(body);
-                // Select a random trap URL
-                const trapUrl = TRAP_PATHS[Math.floor(Math.random() * TRAP_PATHS.length)];
-                // Inject CSS that mimics standard Accessibility Hiding (Bootstrap/Tailwind style)
-                // This reduces the element to a 1x1 pixel clip that is technically "visible" but unclickable.
-                const cssCamouflage = `
-                    <style>
-                        .sr-only-utility {
-                            position: absolute;
-                            width: 1px;
-                            height: 1px;
-                            padding: 0;
-                            margin: -1px;
-                            overflow: hidden;
-                            clip: rect(0, 0, 0, 0);
-                            white-space: nowrap;
-                            border: 0;
-                        }
-                    </style>
-                `;
-                // Inject the link with a boring name ("Skip to content", "Toolbar")
-                // A bot sees this as a valid navigation aid.
-                $('head').append(cssCamouflage);
-                $('body').prepend(`<a href="${trapUrl}" class="sr-only-utility">Skip to Content</a>`);
-                body = $.html();
-            }
-            originalSend.call(this, body);
-        };
+    logger.info('HoneyWeb initialized', {
+        aiEnabled: config.ai.enabled,
+        rateLimitEnabled: config.rateLimit.enabled,
+        dashboardEnabled: config.dashboard.enabled,
+        storageType: config.storage.type
+    });
-        next();
-    };
+    return middleware;
 }
-module.exports = honeyWeb;
+// Export for backward compatibility
+module.exports = honeyWeb;

package/middleware/blocklist-checker.js ADDED Viewed

@@ -0,0 +1,34 @@
+// honeyweb-core/middleware/blocklist-checker.js
+// Blocklist checking middleware
+/**
+ * Create blocklist checker middleware
+ * @param {Object} storage - Storage instance
+ * @param {Object} logger - Logger instance
+ * @param {Object} events - Event emitter
+ * @returns {Function} - Middleware function
+ */
+function createBlocklistChecker(storage, logger, events) {
+    return async function checkBlocklist(req, res, next) {
+        const clientIP = req.ip || req.connection.remoteAddress;
+        try {
+            const isBanned = await storage.isBanned(clientIP);
+            if (isBanned) {
+                logger.blocked(clientIP, 'IP is banned');
+                events.emitRequestBlocked(clientIP, 'IP is banned');
+                return res.status(403).send(
+                    '<h1>403 Forbidden</h1><p>Your IP has been flagged for suspicious activity.</p>'
+                );
+            }
+        } catch (err) {
+            logger.error('Error checking blocklist', { error: err.message });
+        }
+        next();
+    };
+}
+module.exports = createBlocklistChecker;

package/middleware/dashboard.js ADDED Viewed

@@ -0,0 +1,277 @@
+// honeyweb-core/middleware/dashboard.js
+// Dashboard middleware (extracted from main index.js)
+/**
+ * Create dashboard middleware
+ * @param {Object} config - Configuration
+ * @param {Object} storage - Storage instance
+ * @param {Object} botTracker - Bot tracker instance
+ * @param {Object} detector - Detection engine
+ * @returns {Function} - Middleware function
+ */
+function createDashboard(config, storage, botTracker, detector) {
+    const dashboardPath = config.dashboard.path;
+    const dashboardSecret = config.dashboard.secret;
+    return async function dashboard(req, res, next) {
+        // Only handle dashboard path
+        if (req.path !== dashboardPath) {
+            return next();
+        }
+        // Check authentication
+        const key = req.query.key;
+        if (key !== dashboardSecret) {
+            return res.status(401).send('<h1>401 Unauthorized</h1><p>Invalid dashboard key.</p>');
+        }
+        try {
+            // Get banned IPs
+            const bannedIPs = await storage.getAll();
+            const stats = await storage.getStats();
+            const detectionStats = detector.getStats();
+            // Get legitimate bot visits
+            const botVisits = botTracker.getAllVisits();
+            const botStats = botTracker.getStats();
+            // Generate HTML dashboard
+            const html = `
+<!DOCTYPE html>
+<html>
+<head>
+    <title>HoneyWeb Status Dashboard</title>
+    <style>
+        body {
+            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+            max-width: 1200px;
+            margin: 40px auto;
+            padding: 20px;
+            background: #f5f5f5;
+        }
+        h1 {
+            color: #333;
+            border-bottom: 3px solid #ff6b6b;
+            padding-bottom: 10px;
+        }
+        .stats {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+            gap: 20px;
+            margin: 20px 0;
+        }
+        .stat-card {
+            background: white;
+            padding: 20px;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .stat-card h3 {
+            margin: 0 0 10px 0;
+            color: #666;
+            font-size: 14px;
+            text-transform: uppercase;
+        }
+        .stat-card .value {
+            font-size: 32px;
+            font-weight: bold;
+            color: #ff6b6b;
+        }
+        table {
+            width: 100%;
+            background: white;
+            border-collapse: collapse;
+            border-radius: 8px;
+            overflow: hidden;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        th {
+            background: #ff6b6b;
+            color: white;
+            padding: 12px;
+            text-align: left;
+        }
+        td {
+            padding: 12px;
+            border-bottom: 1px solid #eee;
+        }
+        tr:hover {
+            background: #f9f9f9;
+        }
+        .timestamp {
+            color: #666;
+            font-size: 12px;
+        }
+        .reason {
+            color: #ff6b6b;
+            font-weight: 500;
+        }
+        .bot-section {
+            margin-top: 40px;
+        }
+        .bot-card {
+            background: white;
+            border-radius: 8px;
+            padding: 20px;
+            margin-bottom: 20px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .bot-card h3 {
+            margin: 0 0 10px 0;
+            color: #4CAF50;
+            display: flex;
+            align-items: center;
+            gap: 10px;
+        }
+        .verified-badge {
+            background: #4CAF50;
+            color: white;
+            padding: 4px 8px;
+            border-radius: 4px;
+            font-size: 11px;
+            font-weight: bold;
+        }
+        .unverified-badge {
+            background: #ff9800;
+            color: white;
+            padding: 4px 8px;
+            border-radius: 4px;
+            font-size: 11px;
+            font-weight: bold;
+        }
+        .visit-entry {
+            padding: 10px;
+            border-left: 3px solid #4CAF50;
+            margin: 10px 0;
+            background: #f9f9f9;
+        }
+        .visit-path {
+            font-family: 'Courier New', monospace;
+            color: #333;
+            font-weight: bold;
+        }
+        .visit-meta {
+            color: #666;
+            font-size: 12px;
+            margin-top: 5px;
+        }
+        .no-bots {
+            text-align: center;
+            padding: 40px;
+            color: #666;
+            background: white;
+            border-radius: 8px;
+        }
+    </style>
+</head>
+<body>
+    <h1>🍯 HoneyWeb Status Dashboard</h1>
+    <div class="stats">
+        <div class="stat-card">
+            <h3>Total Banned IPs</h3>
+            <div class="value">${stats.total}</div>
+        </div>
+        <div class="stat-card">
+            <h3>Active Bans</h3>
+            <div class="value">${stats.active}</div>
+        </div>
+        <div class="stat-card">
+            <h3>Legitimate Bots</h3>
+            <div class="value" style="color: #4CAF50;">${botStats.totalBots}</div>
+        </div>
+        <div class="stat-card">
+            <h3>Bot Visits</h3>
+            <div class="value" style="color: #4CAF50;">${botStats.totalVisits}</div>
+        </div>
+        ${detectionStats.rateLimiter ? `
+        <div class="stat-card">
+            <h3>Tracked IPs</h3>
+            <div class="value">${detectionStats.rateLimiter.trackedIPs}</div>
+        </div>
+        ` : ''}
+    </div>
+    <div class="bot-section">
+        <h2>🤖 Legitimate Bot Activity</h2>
+        ${Object.keys(botVisits).length === 0 ? `
+            <div class="no-bots">
+                <p>No legitimate bots detected yet.</p>
+                <p style="font-size: 12px; margin-top: 10px;">
+                    Googlebot, Bingbot, and other search engines will appear here when they visit your site.
+                </p>
+            </div>
+        ` : Object.entries(botVisits).map(([botName, visits]) => `
+            <div class="bot-card">
+                <h3>
+                    ${botName}
+                    <span class="verified-badge">${visits.filter(v => v.verified).length} verified</span>
+                    ${visits.filter(v => !v.verified).length > 0 ? `<span class="unverified-badge">${visits.filter(v => !v.verified).length} unverified</span>` : ''}
+                </h3>
+                <p style="color: #666; font-size: 14px; margin-bottom: 15px;">
+                    Total visits: ${visits.length} | Most recent: ${new Date(visits[0].timestamp).toLocaleString()}
+                </p>
+                <details>
+                    <summary style="cursor: pointer; margin-bottom: 10px;">View recent visits (last ${Math.min(visits.length, 10)})</summary>
+                    ${visits.slice(0, 10).map(visit => `
+                        <div class="visit-entry">
+                            <div class="visit-path">${visit.path}</div>
+                            <div class="visit-meta">
+                                IP: <code>${visit.ip}</code> |
+                                ${visit.verified ? '✅ DNS Verified' : '⚠️ Unverified'} |
+                                ${new Date(visit.timestamp).toLocaleString()}
+                            </div>
+                        </div>
+                    `).join('')}
+                </details>
+            </div>
+        `).join('')}
+    </div>
+    <h2>🚫 Banned IP Addresses</h2>
+    ${bannedIPs.length === 0 ? '<p>No banned IPs yet.</p>' : `
+    <table>
+        <thead>
+            <tr>
+                <th>IP Address</th>
+                <th>Reason</th>
+                <th>Banned At</th>
+                <th>Expires At</th>
+            </tr>
+        </thead>
+        <tbody>
+            ${bannedIPs.map(entry => {
+                const ip = typeof entry === 'string' ? entry : entry.ip;
+                const reason = typeof entry === 'string' ? 'Suspicious activity' : entry.reason;
+                const timestamp = typeof entry === 'string' ? 'N/A' : new Date(entry.timestamp).toLocaleString();
+                const expiry = typeof entry === 'string' ? 'Never' : new Date(entry.expiry).toLocaleString();
+                return `
+                <tr>
+                    <td><code>${ip}</code></td>
+                    <td class="reason">${reason}</td>
+                    <td class="timestamp">${timestamp}</td>
+                    <td class="timestamp">${expiry}</td>
+                </tr>
+                `;
+            }).join('')}
+        </tbody>
+    </table>
+    `}
+    <p style="margin-top: 40px; color: #666; text-align: center;">
+        HoneyWeb v2.0.1 | Refresh page to update data
+    </p>
+</body>
+</html>
+            `;
+            res.send(html);
+        } catch (err) {
+            console.error('[Dashboard] Error generating dashboard:', err);
+            res.status(500).send('<h1>500 Internal Server Error</h1>');
+        }
+    };
+}
+module.exports = createDashboard;

package/middleware/index.js ADDED Viewed

@@ -0,0 +1,73 @@
+// honeyweb-core/middleware/index.js
+// Middleware factory - orchestrates all middleware components
+const createBlocklistChecker = require('./blocklist-checker');
+const createRequestAnalyzer = require('./request-analyzer');
+const createTrapInjector = require('./trap-injector');
+const createDashboard = require('./dashboard');
+/**
+ * Create HoneyWeb middleware stack
+ * @param {Object} config - Configuration
+ * @param {Object} storage - Storage instance
+ * @param {Object} botTracker - Bot tracker instance
+ * @param {Object} detector - Detection engine
+ * @param {Object} aiAnalyzer - AI analyzer
+ * @param {Object} logger - Logger instance
+ * @param {Object} events - Event emitter
+ * @returns {Function} - Express middleware function
+ */
+function createMiddleware(config, storage, botTracker, detector, aiAnalyzer, logger, events) {
+    // Create individual middleware components
+    const blocklistChecker = createBlocklistChecker(storage, logger, events);
+    const requestAnalyzer = createRequestAnalyzer(config, storage, botTracker, detector, aiAnalyzer, logger, events);
+    const trapInjector = createTrapInjector(config);
+    const dashboard = config.dashboard.enabled
+        ? createDashboard(config, storage, botTracker, detector)
+        : null;
+    // Return combined middleware function
+    return async function honeyWebMiddleware(req, res, next) {
+        try {
+            // 1. Dashboard (if enabled and path matches)
+            if (dashboard && req.path === config.dashboard.path) {
+                return dashboard(req, res, next);
+            }
+            // 2. Check blocklist
+            await new Promise((resolve, reject) => {
+                blocklistChecker(req, res, (err) => {
+                    if (err) reject(err);
+                    else resolve();
+                });
+            });
+            // If response was sent (blocked), stop here
+            if (res.headersSent) {
+                return;
+            }
+            // 3. Analyze request (traps + threats)
+            await new Promise((resolve, reject) => {
+                requestAnalyzer(req, res, (err) => {
+                    if (err) reject(err);
+                    else resolve();
+                });
+            });
+            // If response was sent (blocked), stop here
+            if (res.headersSent) {
+                return;
+            }
+            // 4. Inject traps into HTML responses
+            trapInjector(req, res, next);
+        } catch (err) {
+            logger.error('Middleware error', { error: err.message });
+            next(err);
+        }
+    };
+}
+module.exports = createMiddleware;