Package: netsink
Network sinkhole for isolated malware analysis.Overviewnetsinkis a network daemon that will bind to any number of configured IP ports
and provide fake services in an attempt to convince running malware that it has an active
Internet connection.Getting StartedInstall usingpip:pip install netsinkStart thenetsinklisteners with the default configuration
(you will need administrator/root access to bind to privilleged ports):sudo netsinkYou should see output similar to the following, showing the bound ports:2013-03-03 21:01:02,710 [netsink] INFO: Listener 'http' awaiting TCP activity on port/s [80, 8000, 8080, 8090]
2013-03-03 21:01:02,717 [netsink] INFO: Listener 'https' awaiting SSL activity on port/s [443, 8443]
2013-03-03 21:01:02,726 [netsink] INFO: Listener 'dns' awaiting UDP activity on port/s [53]
2013-03-03 21:01:02,726 [netsink] INFO: Waiting...To test, open a browser on the same host and navigate tohttps://127.0.0.1/testingand
you should see a netsink response page.Client SetupTo be useful a client machine must be forced to redirect their traffic to the services
on thenetsinkhost.  This can be achieved in several ways.Static DNS Configurationnetsinkincludes a DNS server that will advertise
itself as the destination for any client DNS requests (or as otherwise configured).
Change the client’s network interface to use thenetsinkhost’s address as its
DNS server.  Also set the Default Gateway to thenetsinkhost if usingiptablesredirection, to capture direct IP address communication attempts.DHCP ConfigurationNot currently provided by thenetsinkpackage, however, if
installing on a unix/linux platform, using the operating system’s DHCP server package
can be effective (for exampleisc-dhcp-serveron ubuntu).  Set the netsink host
as the address to be returned for DNS and Default Gateway to the clients.  Set the client’s
network interface to obtain an address automatically.To test, ensure that any changes have been applied to the client’s network interface.
On Windows, in a command window:ipconfig /allThe netsink host’s address should be listed as the DNS server on the applicable network
interface.  Now open a web browser on the client and navigate to www.google.com you
should instead see the netsink response page and the DNS/HTTP requests logged on the server.GoalsThe primary project goals are:Provide malware with communication end points to assist execution and elicit network traffic.Straight-forward installation.  Should work out-of-the-box, with minimal configuration, for most scenarios.Easy configuration and extension.  Adding custom services and response handling should be as simple as possible.FeaturesDNS redirection based on simple config fileHTTP/HTTPS serving of static files based on url regexesImitate known external IP address lookup sites (thanks toipgetterfor the compiled list)IRC service to capture connect and channel joins, etc.SMTP/ESMTP server including AUTH and STARTTLS supportFTP server supportListening port ranges easily configurable and separate from the modules that handle the traffic.Automatic connection redirection for platforms that supportiptablesGeneric port listener that can dispatch to other modules via packet inspectionPlanned Additions:Internal DHCP server to auto configure clientsExpand available fake services to include POP3, IMAP, TFTP, etc.Pluggable fake C2 serversBetter documentationIssuesSource code fornetsinkis hosted onGitHub. Any bug reports or feature
requests can be made using GitHub’sissues system.