Ensnare

Open source framework for network traffic analysis with advanced features.

Ensnare is provided as a gem plugin for Ruby on Rails. It was designed to enable users to configure and deploy a basic detection and response system for malicious behavior in under ten minutes. Ensnare employs a mix of Honey Traps to attract malicious users, along with a customizable suite of Trap Responses that can confuse, mislead, delay, or halt an attacker. Already familiar with the tool and eager to try it out? Here’s how to get started! - First, install the gem by adding it to your project's Gemfile: gem 'ensnare', :git => '[email protected]:ahoernecke/Ensnare.git' - Next, install the gem: bundle install - Run the migrations for Ensnare with the following commands: rake ensnare:install:migrations followed by rake db:migrate - Enable parameter tampering for your application by modifying the mass_assignment_sanitizer: vi config/environments/.rb - Set config.active_record.mass_assignment_sanitizer to logger by adding: config.active_record.mass_assignment_sanitizer = :logger - Enable Ensnare in your application_controller.rb file: vi app/controllers/application_controller.rb - Append the following filter below protect_from_forgery in your application_controller.rb file: before_filter :ensnare - Lastly, add the following line to the end of your routes.rb file: mount Ensnare::Engine => "/ensnare", :a