tests package

Submodules

tests.test module

class tests.test.Test(target_honeypot=None)

Bases: object

Interface all Tests must extend from Please inspect this interface and other Tests before you write your own

__init__(target_honeypot=None)

Instantiate a new Test

Parameters:target_honeypot – optional target Honeypot (can also be set later)

default_description = 'No description defined for this test'

default_karma = 10

default_name = 'UnknownName'

default_report = 'This test did not provide a report of its findings'

description = 'No description defined for this test'

doc_file = '_not_found_manual.html'

doc_online_root = 'http://checkpot.readthedocs.io/en/master/test_manuals/'

karma

karma_value = 10

name = 'UnknownName'

report

reset()

Resets the result and report of the test to defaults so it can be run again

result

run()

All tests must implement their own run() method and write docstrings for it. run() should never be called directly, the TestPlatform takes care of all initialisations.

Returns:this method returns nothing, however, before return set_result() should be called

set_result(result=<TestResult.UNKNOWN: 2>, *report)

Stores the result and report of this test

Parameters:

• result – result of the test
• report – accurate report of findings the test has made

target_honeypot

class tests.test.TestResult

Bases: enum.Enum

Lists all possible results for a test

NOT_APPLICABLE = 3

OK = 0

UNKNOWN = 2

WARNING = 1

tests.test_platform module

class tests.test_platform.TestPlatform(test_list, target_honeypot)

Bases: object

Holds a list of Tests and a reference to a Honeypot Runs the list of tests on the Honeypot and generates statistics based on the results

__init__(test_list, target_honeypot)

Parameters:

• test_list – list of Test objects
• target_honeypot – Honeypot object to run Tests against

get_stats()

Calculates statistics based on the last scan

Returns:tuple containing number of ok, warnings, unknown

static print_header()

static print_results(test_result, test_name, test_karma, test_report, test_doc_link)

print_stats()

results

Returns the results of each test

Returns:list of tuples like (Test Name, Test Report, Test Result)

run_tests(verbose=False, brief=False)

Runs the list of tests on the target Honeypot

Parameters:

• verbose – print results of each test
• brief – disable output for N/A tests

tests.default_ftp module

class tests.default_ftp.DefaultFTPBannerTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Tests usage of default service banners'

doc_file = 'default_banner.html'

karma_value = 100

name = 'Default FTP Banner Test'

run()

Check if banner matches any known banner

tests.default_http module

class tests.default_http.CertificateValidationTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Check validity of SSL certificates'

doc_file = 'invalid_certificate.html'

karma_value = 20

name = 'Certificate Validation Test'

run()

Check validity of SSL certificates

class tests.default_http.DefaultGlastopfWebsiteTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Test unchanged source for website content'

doc_file = 'default_glastopf_site.html'

karma_value = 60

name = 'Default Glastopf Website Content Test'

run()

Check if content matches known content

class tests.default_http.DefaultStylesheetTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Test unchanged website stylesheet'

doc_file = 'default_stylesheet.html'

karma_value = 30

name = 'Default Website Stylesheet Test'

run()

Check if content matches known content

class tests.default_http.DefaultWebsiteTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Test unchanged website content'

doc_file = 'default_website.html'

karma_value = 60

name = 'Default Website Test'

run()

Check if webpage has a known hash

tests.default_imap module

class tests.default_imap.DefaultIMAPBannerTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Tests usage of default IMAP banners'

doc_file = 'default_banner.html'

karma_value = 90

name = 'Default IMAP Banner Test'

run()

Check if content matches any known content

tests.default_smtp module

class tests.default_smtp.DefaultSMTPBannerTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Tests usage of default SMTP banners'

doc_file = 'default_banner.html'

karma_value = 100

name = 'Default SMTP Banner Test'

run()

Check if content matches any known content

tests.default_telnet module

class tests.default_telnet.DefaultTelnetBannerTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Tests usage of default telnet banners'

doc_file = 'default_banner.html'

karma_value = 100

name = 'Default Telnet Banner Test'

run()

Check if content matches any known content

tests.default_templates module

class tests.default_templates.DefaultTemplateFileTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Tests usage of default running templates'

doc_file = 'default_template.html'

karma_value = 100

name = 'Default Template File Test'

run()

Check if content matches any known content

tests.direct_fingerprinting module

class tests.direct_fingerprinting.DefaultServiceCombinationTest(target_honeypot=None)

Bases: tests.test.Test

Check if the running services combination is the default configuration for popular Honeypots

default_ports = {'amun': [21, 23, 25, 42, 80, 105, 110, 135, 139, 143, 443, 445, 554, 587, 617, 1023, 1025, 1080, 1111, 1581, 1900, 2101, 2103, 2105, 2107, 2380, 2555, 2745, 2954, 2967, 2968, 3127, 3128, 3268, 3372, 3389, 3628, 5000, 5168, 5554, 6070, 6101, 6129, 7144, 7547, 8080, 9999, 10203, 27347, 38292, 41523], 'artillery': [21, 22, 25, 53, 110, 1433, 1723, 5800, 5900, 8080, 10000, 16993, 44443], 'dionaea': [21, 42, 80, 135, 443, 445, 1433, 1723, 3306, 5060, 5061], 'honeypy': [7, 8, 23, 24, 2048, 4096, 10007, 10008, 10009, 10010]}

description = 'Check if the running services combination is the default configuration for popular Honeypots'

doc_file = 'default_service_combination.html'

karma_value = 50

name = 'Default Service Combination Test'

run()

Check if the running services combination is the default configuration for popular Honeypots

threshold = 70

class tests.direct_fingerprinting.DirectFingerprintTest(target_honeypot=None)

Bases: tests.test.Test

Check if the nmap scan directly fingerprints any service as a honeypot

description = 'Check if the nmap scan directly fingerprints any service as a honeypot'

doc_file = 'direct_fingerprinting.html'

karma_value = 100

name = 'Direct Fingerprint Test'

run()

Check if the nmap scan directly fingerprints any service as a honeypot

class tests.direct_fingerprinting.DuplicateServicesCheck(target_honeypot=None)

Bases: tests.test.Test

Check if the machine is running duplicate services

description = 'Check if the machine is running duplicate services'

doc_file = 'duplicate_services.html'

karma_value = 30

name = 'Duplicate Services Check'

run()

Check if the machine is running duplicate services

class tests.direct_fingerprinting.OSServiceCombinationTest(target_honeypot=None)

Bases: tests.test.Test

Check if the OS and running services combination makes sense

description = 'Check if the OS and running services combination makes sense'

doc_file = 'os_service_combination.html'

karma_value = 90

linux_exclusive = []

name = 'OS Service combination test'

run()

Check if the OS and running services combination makes sense

windows_exclusive = ['ms-sql', 'iis', 'windows', 'microsoft']

tests.old_version_bugs module

class tests.old_version_bugs.KippoErrorMessageBugTest(target_honeypot=None)

Bases: tests.test.Test

description = 'Tests presence of an obsolte version of kippo'

doc_file = 'old_version_bugs.html'

karma_value = 100

name = 'Kippo Error Message Bug Test'

run()

Check if content matches any known content

tests.service_implementation module

class tests.service_implementation.HTTPTest(target_honeypot=None)

Bases: tests.test.Test

Tests HTTP service implementation

check_http_implemented(server_address, port=80)

description = 'Tests HTTP service implementation'

doc_file = 'implementation.html'

karma_value = 60

name = 'HTTP Test'

run()

Verify service implements all methods in the HTTP specification

class tests.service_implementation.SMTPTest(target_honeypot=None)

Bases: tests.test.Test

Tests SMTP service implementation

check_smtp_implemented(server_address, port=25)

description = 'Tests SMTP service implementation'

doc_file = 'implementation.html'

karma_value = 60

name = 'SMTP Test'

run()

Verify service implements all methods in the SMTP specification

Module contents