kolya5544/bearftpHoneypot FTP server written in .NET Core (C#) for both Linux and Windows.
BearFTP is a honeypot FTP server, designed to log hackers' attempts and report them to public IP blacklist databases.
This software was tested and runs perfectly on:
We use several projects as dependencies to run smoothly:
BearFTP requires .NET Core 3.1 or higher.
Download binaries from Release tab or compile it yourself.
If you are on Windows, run
C:/BearFTP/BearFTP/bin/Release/netcoreapp3.1> ./BearFTP.exe
For Linux, run
$ dotnet BearFTP.dll
The program should exit with an error. Proceed to editing the config.json
{
"PortDef": 21,
"PortPasv": 21,
"Hostname": "127.0.0.1",
"Banner": "My very own FTP server located at %host%",
"Token": "",
"Report": true,
"Ban": true,
"PunishScans": true,
"AllowAnonymous": false,
"PerIPLogs": false,
"AnonStat": true,
"ConsoleLogging": true,
"ActiveMode": true,
"Max_PerSecond": 5,
"Max_Total": 6,
"BanLength": 3600,
"MaxErrors": 6,
"BufferSize": 8192,
"MaxThreads": 50,
"Files": [
{
"Name": "readme.txt",
"Content": "Hello!"
}]
}
To make it work, you should change PortPasv to any other value, so PortPasv is not equal to PortDef. Other options are optional. We highly dont recommend using files with size of more than 4 MB! You should not use honeypot as a real FTP server to share files!
Want to contribute? Great!
We use VS2019 and .NET core 3.1 for development.
Here's our CURRENT todo list:
MIT
| Key | Value |
|---|
| PortDef | Replace with port you want to use for new connections (21 by default) |
| PortPasv | Replace with port for PASV mode (1222 by default) |
| Hostname | Replace with an actual public IPv4 of your PC/server. Used to initiate PASV connections. Please use IPv4, we dont support domains |
| Banner | Banner sent right after TCP handshake. %host% will be replaced with current hostname |
| Token | AbuseIPDB token to report bad ones |
| Report | Should we report suspicious actions? |
| Ban | Should we ban users on suspicious actions? (Ban is 1 hour long to prevent people from being double-reported) |
| PunishScans | Should we ban/report nmap scanners? |
| AllowAnonymous | Should we allow users to login with "anonymous" username? |
| PerIPLogs | Create logs for individual IPs. Requires "iplogs" folder |
| AnonStat | Do you want to send anonymous statistics on version usage? (We only see BearFTP version you use. No private info) |
| ConsoleLogging | Should we log attempts to the console? |
| ActiveMode | Should we allow Active mode usage? (PORT command) |
| Max_PerSecond | Max. amount of connections per second from an IP. Only applies to base socket |
| Max_Total | Max. amount of active connections from an IP. Applies to both base and PASV |
| BanLength | Length (in seconds) of a ban. 3600 seconds = 1 hour. |
| MaxErrors | Max.amount of attempts to execute an invalid FTP command. |
| BufferSize | Buffer size on RETR for files. Somewhere around 2048-8192 is fine. Determines the speed of a download. |
| MaxThreads | Maximal amount of threads, controlled by clients, that can be spawned by BearFTP |
| Files[] | Array of files. |
| Files[Name] | Filename |
| Files[Content] | Contents of files (string). Start with --- to make it load from a file (example: "---file.exe") |