using --interface causes an error

[panix187]

I tried starting up SNARE with --interface because it looks like it was only binding to the ip6 localhost so I thought this might force it to use the IP4 bind. Here's what I get:

root@honeypot:/honeypots/snare# python3 snare.py --interface eth0 --port 80 --page-dir www.mywebsite.com

   _____ _   _____    ____  ______
  / ___// | / /   |  / __ \/ ____/
  \__ \/  |/ / /| | / /_/ / __/
 ___/ / /|  / ___ |/ _, _/ /___
/____/_/ |_/_/  |_/_/ |_/_____/

    
can't crate meta tag
server
Process Process-1:
Traceback (most recent call last):
  File "/usr/lib/python3.5/multiprocessing/process.py", line 249, in _bootstrap
    self.run()
  File "/usr/lib/python3.5/multiprocessing/process.py", line 93, in run
    self._target(*self._args, **self._kwargs)
  File "snare.py", line 378, in server
    srv = loop.run_until_complete(future)
  File "/usr/lib/python3.5/asyncio/base_events.py", line 457, in run_until_complete
    return future.result()
  File "/usr/lib/python3.5/asyncio/futures.py", line 292, in result
    raise self._exception
  File "/usr/lib/python3.5/asyncio/tasks.py", line 241, in _step
    result = coro.throw(exc)
  File "/usr/lib/python3.5/asyncio/base_events.py", line 989, in create_server
    infos = yield from tasks.gather(*fs, loop=self)
  File "/usr/lib/python3.5/asyncio/futures.py", line 379, in __iter__
    yield self  # This tells Task to wait for completion.
  File "/usr/lib/python3.5/asyncio/tasks.py", line 297, in _wakeup
    future.result()
  File "/usr/lib/python3.5/asyncio/futures.py", line 292, in result
    raise self._exception
  File "/usr/lib/python3.5/asyncio/tasks.py", line 241, in _step
    result = coro.throw(exc)
  File "/usr/lib/python3.5/asyncio/base_events.py", line 937, in _create_server_getaddrinfo
    flags=flags, loop=self)
  File "/usr/lib/python3.5/asyncio/futures.py", line 379, in __iter__
    yield self  # This tells Task to wait for completion.
  File "/usr/lib/python3.5/asyncio/tasks.py", line 297, in _wakeup
    future.result()
  File "/usr/lib/python3.5/asyncio/futures.py", line 292, in result
    raise self._exception
  File "/usr/lib/python3.5/concurrent/futures/thread.py", line 55, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/usr/lib/python3.5/socket.py", line 733, in getaddrinfo
    for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
socket.gaierror: [Errno -2] Name or service not known
you are running the latest version

Will it only listen on localhost or is there a way to make it bind to an IP?

[panix187]

Wow, after I posted this, it's now binding to 127.0.0.1 instead of ::1 when I took --interface out. Don't know what changed.

Also, I tried cloning an old Joomla 1.0 site and it's not grabbing all the graphics. Is there anything else you guys would recommend on trying to clone to attract attackers?

[afeena]

Hi!
Sorry, in this case "interface" means host ip address, default "interface" is localhost. So, you can only pass the ip to snare (we use aiohttp which want host arg(ip) into its internal function)

Cloning doesn't works equally well on all sites, you can read this issue
It's a bit tricky to make a perfect universal tool, but you can try to clone wordpress site

[panix187]

Gotcha. Usually with something like tcpdump, interface refers to vr0, rl0 and the like. I got it up and working now, bound to the correct IP.

I'll have to try cloning different sites.

Is there any way to host different sites like the hostname directive in Apache?

[glaslos]

I created an issue to avoid future confusion: #35
At the moment hosting multiple sites is not supported. You can use apache with proxy module or nginx with multiple SNARE instances to solve that problem. Issue can be found here: #36