[A·M2] Deception engine #2

New issue

Closed

opened 2026-06-24 23:48:47 +00:00 by vxfemboy · 0 comments

vxfemboy commented

2026-06-24 23:48:47 +00:00

(Migrated from github.com)

Sub-project A, Milestone 2 — the two-tier deception engine that makes closed ports behave like real, running services.

DeceptionTransport trait + NFQUEUE stateless transport
Stateless responders (TCP SYN/ACK + SipHash SYN-cookie, UDP, ICMP/ICMPv6)
TPROXY transport for terminated interactive connections
ServiceEmulator trait + dispatch
Protocol emulators (SSH, HTTP, SMTP, DB/cache, generic banner+tarpit)
Banner/signature store with auto-update + hot-reload
Session capture to audit log + metrics
nftables enforcement wiring (deception set → engine, real → DNAT)

Sub-project A, Milestone 2 — the two-tier deception engine that makes closed ports behave like real, running services. - [ ] DeceptionTransport trait + NFQUEUE stateless transport - [ ] Stateless responders (TCP SYN/ACK + SipHash SYN-cookie, UDP, ICMP/ICMPv6) - [ ] TPROXY transport for terminated interactive connections - [ ] ServiceEmulator trait + dispatch - [ ] Protocol emulators (SSH, HTTP, SMTP, DB/cache, generic banner+tarpit) - [ ] Banner/signature store with auto-update + hot-reload - [ ] Session capture to audit log + metrics - [ ] nftables enforcement wiring (deception set → engine, real → DNAT)