Create an FTP Canary Honeypot from an ESP8266 or ESP32 in 10 minutes

[@SimpleElectronics]

Awesome project and congrats on the library!

[@AnotherMaker]

Thanks!

[@edwardeddy6465]

This is awesome thanks man! I couldn't get this to compile with the newest ESP32 code as of Jul 2022 version is 2.0.3 wont work. So to get this to compile and upload to my ESP32 I went to Board Manager and searched for "ESP32" then chose version 1.0.6 compiled and uploaded no issue then just swapped back to 2.0.3 afterward. Thanks again!

[@AnotherMaker]

Interesting. I'll have to check that out. I'm trying to think of what would allow it to compile the second time after upgrading. I made v2 because people kept saying v1 wouldn't compile on the newer IDEs

[@billybbob18]

Everything about this video caused me to compulsively destroy that "Subscribe" button. Amazing work, especially the cross-compatability.

[@AnotherMaker]

Thank you so much. I really appreciate that!

[@DPCTechnology]

Great stuff man! Keep the Thinkst Canary stuff coming!!

[@AnotherMaker]

Thanks! I'm spacing it out a bit but I definitely have a few more canary things :)

[@deankq4adj125]

This is really cool, I'll add this project to my list of things to do!

[@AnotherMaker]

I think it's definitely worth having one on the network and hopefully it will never get triggered!

[@SpecOPSdan]

Awesome project! Just tried to set it up and sadly was not able to get it to work. Seems to be an issue with communicating with a url. It showed as if it was successful on serial but I never got a email. Tried different webhooks and no dice. Im guessing its probably due to some change on how GET requests are called (not a coder by any means lol) or maybe an API change? Would love to see an update to this!

[@meagrebones]

Gret video and fantastic library, thanks.

[@AnotherMaker]

Thank you!

[@AndreasDelleske]

Great - why not also monitor ssh / sftp / rsync ports? Also on „hidden“ port numbers... I guess it’s safe to say folks using ssh and rsync are not random hobbyists. Also log their user / password combination because that will give hints to what software they are using. One could as well prepare a set of response strings to fake a certain older NAS for example. Just make a full scan to such a device and use those strings.. with a little delay to make the device appear busy.

[@AnotherMaker]

I love this. TBH, my plan for the next update was to make this thing detect not just accessing a port but scanning the port, but I haven't been able to figure out how to do that. Generally the first thing an attacker or someone screwing around is going to do is to nmap/fing your network. I want to detect that. But yeah... ssh/rsync are on the horizon if I can figure them out. It's all based on the arduino http library and there's not much documentation. So in other words they expose what happens when someone connects, but I can't figure out how to grab ahold of "trying" to connect, etc. We'll see.

[@AndreasDelleske]

@@AnotherMaker Keep it up :) I'm pretty sure I'll try it out one day...

[@pd8559]

@@AnotherMaker Ports are not advertised you have to connect to a port and make a request on that protocol and get a response to "scan for a port being available on a particular device" (noisy) or sit and lurk and intercept packets on the wire and decode packet headers and build a map of machines and ports used between them to infer what ports are open on a machine (quieter). Most common ports and services are defined in the RFCS online, just read them to learn each port /protocol /service.

[@murrij]

Great video. Thank you.

[@AnotherMaker]

Thanks!

[@evanwilliam9582]

Bro can you set the AP to deploy a RAT bot to every connected user ? just to take this a step further ?. Then we can have remote access to the target that snooped around on our network. is this possible ? like a NETCAT deployment

[@AnotherMaker]

I can't give out specific advice but I know it's possible to do a captive portal as if you are accessing the Wi-Fi at a hotel or airport. Once you have that, you can basically do anything as long as you can have the user interact with the page

[@evanwilliam9582]

@@AnotherMaker any git hub repos available?

[@johndroyson7921]

I have this working with the doit esp32 dev kit v1. I was able to change the hostname, and MAC addreess. I was also able to resolve the cannot convert 'esp_interface_t' to 'wifi_interface_t' error

[@AnotherMaker]

Awesome. I know library changes have caused issues since I've written this. Do you have your latest code anywhere?

[@johndroyson7921]

Yes. I'm just not sure how to share it.

[@billybbob18]

how did you solve it? Having same issue.

[@johndroyson7921]

@@billybbob18 I think I lost the configuration when my windows machine crashed recently. I was looking all around for it. Sorry :/

[@johndroyson7921]

found a backup! This might be the correct one but idk how to sens PM's here

[@sunsh1nysoul]

I have the ESP8266-DEVKITC and I select the "Generic ESP8266 Module" but am not convinced that is the correct board ... Anyway the code runs without error and runs the conditional code for the 8266 ... When I look for the new WIFI network I see nothing ... not sure how to debug this ... could it be related to the MAC Address ... I tried the one you suggested and also tried the first 3 bytes from our router ... I did try the WifiAccessPoint Arduino project and that works with a new WIFI network visible. Any ideas appreciated.

[@AnotherMaker]

I've never used that board so I may not be very helpful. IIRC I did not use the wifimanager thing on that sketch so you would not see a new network. That device would just show up on your existing network. Does the serial monitor show that you connected to the network and spit out the IP address of the canary?

[@georgef7754]

Excellent. Thank you.

[@AnotherMaker]

You are welcome!

[@jameswar4786]

wow, thanks man!

[@AnotherMaker]

Thanks for watching!

[@erhall55]

I am totally new to Arduino and I am getting a compile error when trying to upload this. Where would you suggest I start?

[@AnotherMaker]

I think you got this sorted out. I need to get to my ESP stuff and see if I can update the library to make this easier for people in the future.

[@SuperBoinger]

Thanks for this tutorial! Im trying to replicate and getting an error on ESPCanary.opp line 171. Declared with obsolete API

[@AnotherMaker]

I haven't seen that. I'll have to try again. I'll see what I can find.

[@SuperBoinger]

@@AnotherMaker I figured it out. Had to go to the ESPCanary.cpp code, and add WiFiClient client; on top of HTTPClient http; and then added "client" to http.begin(client, token) ...no more obsoletr API error! Was able to test it and works like a charm. You rock!

[@fredflintstone1]

great project very useful:-)

[@AnotherMaker]

Many thanks

[@skyking6989]

What software did you use to connect to the ftp server once you flashed code to esp

[@AnotherMaker]

I use a Windows program called putty

[@skyking6989]

@AnotherMaker oh I have putty already. Couldn't see what I was looking at. Need to get a Nmap installed and port scan to find the ip

[@AnotherMaker]

@@skyking6989 if I remember correctly it tells you the I pee over the serial monitor when you boot it

[@skyking6989]

@@AnotherMaker if that's true then makes things much easier

[@smartassist9700]

Can I set it to trigger sound alarm? And message with details? I would set up 3-4 on my network...lol all signal same alarm if possible. I need it to be am alarm loud enough to hear through any room on a small 1 floor home that is 1k sq ft heated space. I am NOT TECHY AT ALL. CAN YOU SHOW EVERY SINGLE STEP (LARGE SCREEN) TO READ WEBSITES, CODE. HOW TO LOAD HARDWARE WITH CODE, HOW TO SOLDER ETHERNET PORT OR USE WIFI. POWER SOURCE CONNECT. ALSO IS THERE A LITTLE BOX TO PUT IT IN? This is MY BUDGET!! EXCITED.... I AM DISABLED AND LOW INCOME. PLEASE ASSIST. I NEED WEBSITES TO BUY HARDWARE, WIRING, POWER SOURCE FOR THIS. MOST HUMBLE APPRECIATION!

[@AnotherMaker]

This has to be possible. I really like IFTTT.com to handle that sort of thing

[@ricardotinoco1593]

Hey man everything works just fine, but one small thing for me. When i try to attemp the canary and it says connecting to "https canary link" but it doenst send an email. If i try to open the link it then sends it. Any idea why it doesnt trigger?

[@MrDandi97]

Hi. Have you figured out what the issue was? Cuz i'm trying to run a sketch similar to this that uses the same library but the token doesn't trigger when i ftp.

[@helotesareacommunityband9126]

Same here. Something changed somewhere?

[@talofer99]

Brilliant :)

[@AnotherMaker]

Thanks!

[@mikemorgan2130]

looking at the code, breaking the two boards into individual "#ifdef #endif" chunks solved all the issues i had with boot. heres my code, alos thanks this is awesome!!! // // #ifdef ESP8266 wifi_set_macaddr(STATION_IF, &newMACAddress[0]); #endif // // #ifdef defined ESP32 WiFi.mode(WIFI_STA); esp_wifi_set_mac(ESP_IF_WIFI_STA, &newMACAddress[0]); #endif