2 |
3 | Canarytokens
4 | =============
5 | by Thinkst Applied Research
6 |
7 | Overview
8 | --------
9 | Canarytokens helps track activity and actions on your network.
10 |
11 | Installation
12 | ------------
13 | We recommend [the Docker image installation process](https://github.com/thinkst/canarytokens-docker).
14 |
15 | Configuration
16 | -------------
17 |
18 | The Canarytokens server can use many different settings configurations. You can find them in `settings.py`. There are two
19 | main settings files: `frontend.env` and `switchboard.env`.
20 |
21 | The `frontend.env` contains the frontend process settings such as:
22 | - CANARY_DOMAINS=mytesttokensdomain.com
23 | - CANARY_NXDOMAINS=pdf.demo.canarytokens.net
24 | - CANARY_AWSID_URL=
32 |
68 |
69 |
70 |
71 |
72 |
--------------------------------------------------------------------------------
/channel_input_imgur.py:
--------------------------------------------------------------------------------
1 | import simplejson
2 |
3 | from twisted.application.internet import TimerService
4 | from twisted.internet.task import deferLater
5 | from twisted.internet import reactor
6 | from twisted.python import log
7 | from twisted.web.client import getPage
8 |
9 | from canarydrop import Canarydrop
10 | from channel import InputChannel
11 | from queries import get_canarydrop, get_all_imgur_tokens, save_imgur_token,\
12 | get_imgur_count
13 | from constants import INPUT_CHANNEL_IMGUR
14 |
15 | class ChannelImgur(InputChannel):
16 | """Input channel that polls imgur for changes to the view count, and
17 | alerts when they climb."""
18 | CHANNEL = INPUT_CHANNEL_IMGUR
19 |
20 | def __init__(self, min_delay=3600, switchboard=None):
21 | super(ChannelImgur, self).__init__(switchboard=switchboard,
22 | name=self.CHANNEL)
23 | self.min_delay = min_delay
24 | self.service = TimerService(self.min_delay, self.schedule_polling)
25 |
26 | def schedule_polling(self,):
27 | """A dummy method. For now, all view count polls are run immediately.
28 | In the future they'll be spread out over the interval."""
29 | delay = 0
30 | for imgur_token in get_all_imgur_tokens():
31 | self.schedule_poll(imgur_token=imgur_token, delay=delay)
32 | delay+=5
33 |
34 | # for imgur_token in get_all_imgur_tokens():
35 | # self.poll(imgur_token=imgur_token)
36 |
37 | def poll(self, imgur_token=None):
38 | try:
39 | count = get_imgur_count(imgur_id=imgur_token['id'])
40 | if count > imgur_token['count']:
41 | canarydrop = Canarydrop(**get_canarydrop(
42 | canarytoken=imgur_token['canarytoken']))
43 | self.dispatch(canarydrop=canarydrop, count=count,
44 | imgur_id=imgur_token['id'])
45 | imgur_token['count'] = count
46 | save_imgur_token(imgur_token=imgur_token)
47 | except Exception as e:
48 | log.err('Imgur error: {error}'.format(error=e))
49 |
50 | def schedule_poll(self, imgur_token=None, delay=None):
51 | d = deferLater(reactor, delay, self.request_imgur_count, imgur_token)
52 |
53 | def request_imgur_count(self, imgur_token):
54 | d = getPage(
55 | 'http://imgur.com/ajax/views?images={imgur_id}'\
56 | .format(imgur_id=imgur_token['id']),
57 | agent='Canarytokens Imgur Check')
58 | d.addCallback(self.received_imgur_count, imgur_token)
59 | return d
60 |
61 | def received_imgur_count(self, body, imgur_token):
62 | try:
63 | body = simplejson.loads(body)
64 | count = int(body['data'][imgur_token['id']])
65 | log.msg('Count for imgur token '+imgur_token['id']+ ' was '+str(count))
66 | if count > imgur_token['count']:
67 | canarydrop = Canarydrop(**get_canarydrop(
68 | canarytoken=imgur_token['canarytoken']))
69 | self.dispatch(canarydrop=canarydrop, count=count,
70 | imgur_id=imgur_token['id'])
71 | imgur_token['count'] = count
72 | save_imgur_token(imgur_token=imgur_token)
73 | except Exception as e:
74 | log.err('Imgur error: {error}'.format(error=e))
75 |
76 | def format_additional_data(self, **kwargs):
77 | log.msg('%r' % kwargs)
78 | additional_report = ''
79 | if kwargs.has_key('count') and kwargs['count']:
80 | additional_report += 'View Count: {count}\r\n'.format(
81 | count=kwargs['count'])
82 | if kwargs.has_key('imgur_id') and kwargs['imgur_id']:
83 | additional_report += 'Link: http://imgur.com/{imgur_id}\r\n'.format(
84 | imgur_id=kwargs['imgur_id'])
85 | return additional_report
86 |
--------------------------------------------------------------------------------
/smtpd.tac:
--------------------------------------------------------------------------------
1 | import re
2 |
3 | from zope.interface import implements
4 |
5 | from twisted.internet import defer
6 | from twisted.mail import smtp
7 | from twisted.cred.portal import IRealm
8 | from twisted.cred.portal import Portal
9 |
10 |
11 |
12 | class CanaryMessageDelivery:
13 | implements(smtp.IMessageDelivery)
14 |
15 | def __init__(self):
16 | print 'Created CanaryMessageDelivery()'
17 |
18 | def receivedHeader(self, helo, origin, recipients):
19 | return "Received: CanaryMessageDelivery"
20 |
21 | def validateFrom(self, helo, origin):
22 | return origin
23 |
24 | def validateTo(self, user):
25 | # Only messages directed to the "console" user are accepted.
26 | if user.dest.local == "console":
27 | return lambda: CanaryMessage()
28 | raise smtp.SMTPBadRcpt(user)
29 |
30 |
31 |
32 | class CanaryMessage:
33 | implements(smtp.IMessage)
34 |
35 | def __init__(self):
36 | self.headers = []
37 | self.headers_finished = False
38 | self.attachments = []
39 | self.links = []
40 | self.links_re = re.compile('.*(http[s]?://[^\s\'"]+).*', re.I)
41 | self.mime_boundary = None
42 | self.mime_boundary_re = re.compile('.*boundary="([^"]*)"')
43 | self.in_mime_header = True
44 | self.lines = []
45 | self.stored_byte_count = 0
46 |
47 | def lineReceived(self, line):
48 | if line == '' and not self.headers_finished:
49 | self.headers_finished = True
50 |
51 | if not self.headers_finished:
52 | self.headers.append(line)
53 | m = self.mime_boundary_re.match(line)
54 | if m:
55 | self.mime_boundary = m.group(1)
56 | else:
57 | if self.mime_boundary:
58 | if self.in_mime_header:
59 | if line == '':
60 | self.in_mime_header = False
61 | else:
62 | self.attachments[-1].append(line)
63 |
64 | if self.mime_boundary in line:
65 | self.in_mime_header = True
66 | self.attachments.append([])
67 |
68 | if self.stored_byte_count < 5*2**20: #5MB limit
69 | self.lines.append(line)
70 | self.stored_byte_count ++ len(line)
71 |
72 | def eomReceived(self):
73 | print "New message received:"
74 | print "\n".join(self.headers)
75 | print "\n".join(self.links)
76 | print '\n\n'.join([ '\n'.join(x) for x in self.attachments])
77 | self.lines = None
78 | #return defer.succeed(None)
79 | d = defer.Deferred()
80 | d.callback("Success")
81 | return d
82 |
83 | def connectionLost(self):
84 | # There was an error, throw away the stored lines
85 | self.lines = None
86 |
87 |
88 | class CanaryESMTP(smtp.ESMTP):
89 | def __init__(self, **kwargs):
90 | smtp.ESMTP.__init__(self, **kwargs)
91 |
92 | def greeting(self,):
93 | try:
94 | return self.factory.responses['greeting']
95 | except KeyError:
96 | return smtp.ESMTP.greeting(self)
97 |
98 | def receivedHeader(self, helo, origin, recipients):
99 | return "Received: CanaryMessageDelivery"
100 |
101 | def validateFrom(self, helo, origin):
102 | return origin
103 |
104 | def validateTo(self, user):
105 | # Only messages directed to the "console" user are accepted.
106 | if user.dest.local == "console":
107 | return lambda: CanaryMessage()
108 | raise smtp.SMTPBadRcpt(user)
109 |
110 |
111 | class CanarySMTPFactory(smtp.SMTPFactory):
112 | protocol = CanaryESMTP
113 |
114 | def __init__(self, *a, **kw):
115 | self.responses = kw.pop('responses')
116 | smtp.SMTPFactory.__init__(self, *a, **kw)
117 | # self.delivery = CanaryMessageDelivery()
118 |
119 |
120 | def buildProtocol(self, addr):
121 | p = smtp.SMTPFactory.buildProtocol(self, addr)
122 | # p.delivery = self.delivery
123 | # p.challengers = {"LOGIN": LOGINCredentials, "PLAIN": PLAINCredentials}
124 | return p
125 |
126 |
127 |
128 | class SimpleRealm:
129 | implements(IRealm)
130 |
131 | def requestAvatar(self, avatarId, mind, *interfaces):
132 |
133 | if smtp.IMessageDelivery in interfaces:
134 | return smtp.IMessageDelivery, CanaryMessageDelivery(), lambda: None
135 | raise NotImplementedError()
136 |
137 |
138 |
139 | def main():
140 | from twisted.application import internet
141 | from twisted.application import service
142 |
143 | portal = Portal(SimpleRealm())
144 | # checker = InMemoryUsernamePasswordDatabaseDontUse()
145 | # checker.addUser("guest", "password")
146 | # portal.registerChecker(checker)
147 |
148 | responses = {'data_success': 'Finished', 'greeting': 'Hello there'}
149 | a = service.Application("Canary SMTP Server")
150 | internet.TCPServer(2500, CanarySMTPFactory(portal, responses=responses)).setServiceParent(a)
151 |
152 | return a
153 |
154 | application = main()
155 |
--------------------------------------------------------------------------------
/templates/emails/reset.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
33 |
43 |
44 |
45 |
48 | What is this and why should I care?
49 |
50 |
51 |
44 |
45 | 
46 |
47 |
48 | What is this and why should I care?
49 |
52 |
58 |
59 |
60 |
61 |
66 |
67 | | 33 | 101 | | 102 |
 }}){kind=logo}
{{fortune}}
| 34 | 198 | | 199 |
67 | Saved settings.
68 |
69 | {%endif%}
70 |
90 | 102 |
103 |
104 | {%endif%}
105 | History:
106 | -
107 | {% for item in canarydrop['triggered_list']|sort(reverse=True) %}
108 |
109 |
270 | {% endfor %}
271 |
272 | Date: {{ item|e }} 110 | IP: {{ canarydrop['triggered_list'][item]['src_ip'] }} 111 | Channel: {{ canarydrop['triggered_list'][item]['input_channel'] }} 112 | {%if canarydrop['triggered_list'][item]['geo_info'] != None and 113 | canarydrop['triggered_list'][item]['geo_info'] is defined and 114 | canarydrop['triggered_list'][item]['geo_info']['country'] != None and 115 | canarydrop['triggered_list'][item]['geo_info']['country'] is defined %} 116 | Country:{{canarydrop['triggered_list'][item]['geo_info']['country']}} 117 |
118 | {%else%} 119 | Country: Unknown 120 | {%endif%} 121 |
122 | {% if canarydrop['triggered_list'][item]['geo_info'] %}
123 |
124 |
176 | {%endif%}
177 | {% if canarydrop['triggered_list'][item]['is_tor_relay'] != None %}
178 |
179 |
195 | {%endif%}
196 |
197 | {% for field in canarydrop['triggered_list'][item] %}
198 | {% if canarydrop['triggered_list'][item][field] != None and
199 | canarydrop['triggered_list'][item][field] is defined and
200 | field not in ['geo_info','is_tor_relay','additional_info','secretkeeper_photo'] %}
201 | {% if field not in ['src_ip','input_channel'] %}
202 |
203 |
219 | {%endif%}
220 | {%endif%}
221 | {% endfor %}
222 | {% if canarydrop['triggered_list'][item]['additional_info'] %}
223 |
224 | Additional Info
225 |
266 | {% endif %}
267 |
268 |
269 | | 128 | Geo Info 129 | | 130 ||
| Country | 134 |135 | {{ canarydrop['triggered_list'][item]['geo_info']['country'] }} 136 | 137 | | 138 |
| City | 143 |144 | {{ canarydrop['triggered_list'][item]['geo_info']['city'] }} 145 | | 146 |
| Region | 151 |152 | {{ canarydrop['triggered_list'][item]['geo_info']['region'] }} 153 | | 154 |
| Organisation | 159 |160 | {{ canarydrop['triggered_list'][item]['geo_info']['org'] }} 161 | | 162 |
| Hostname | 167 |168 | {{ canarydrop['triggered_list'][item]['geo_info']['hostname'] }} 169 | | 170 |
183 | 
184 | |
185 | |
| 188 | Known Exit Node 189 | | 190 |191 | {{ canarydrop['triggered_list'][item]['is_tor_relay']==True }} 192 | | 193 |
| 207 | Basic Info 208 | | 209 ||
| 212 | {{field}} 213 | | 214 |215 | {{ canarydrop['triggered_list'][item][field]|e }} 216 | | 217 |
| 230 | {{info}} 231 | | 232 | {%if info == 'iOS-App'%} 233 | 236 | {% else %} 237 | {% if info == 'secretkeeper_photo'%} 238 ||
| 240 | Photo 241 | | 242 |
243 | }})
244 | |
245 |
| 255 | {{info_item}} 256 | | 257 |258 | {{ canarydrop['triggered_list'][item]['additional_info'][info][info_item][0] == '1' 259 | if info_item in ['enabled','installed'] 260 | else canarydrop['triggered_list'][item]['additional_info'][info][info_item]|join(', ') }} 261 | | 262 |