A honey token manager and alert system for AWS.

Last update: Nov 09, 2022

Overview

SpaceSiren

SpaceSiren is a honey token manager and alert system for AWS. With this fully serverless application, you can create and manage honey tokens at scale -- up to 10,000 per SpaceSiren instance -- at close to no cost.¹

How It Works

SpaceSiren provides an API to create no-permission AWS IAM users and access keys for those users.
You sprinkle the access keys wherever you like, for example in proprietary code or private data stores.
If one of those sources gets breached, an attacker is likely to use the stolen key to see what they can do with it.
You will receive an alert that someone attempted to use the key.

Alert Outputs

Email
PagerDuty
Slack
Pushover

Documentation Pages

Requirements

As with any open source project, this one assumes you have the required foundational tools and knowledge, mainly in AWS and Terraform.

Resources

Terraform >= 0.13
AWS CLI
A dedicated AWS account with admin access
A registered domain

Knowledge

Basic Terraform
Basic REST API
Basic AWS CLI, S3, and Route 53
Basic AWS Organizations and IAM Roles for cross-account access
Intermediate DNS (delegating a (sub)domain with NS records)

Contact

If you notice a critical security bug (e.g., one that would grant real access to an AWS account), please responsibly disclose it via email at [email protected].

For standard bugs or feature requests, please open a GitHub issue.

Attributions

Special thanks to:

Atlassian for Project SpaceCrab, the inspiration for this project. If you want to read about why I started SpaceSiren, please see my SpaceCrab critique page.
The wonderful and talented Alia Mancisidor for the artwork.
Anyone who volunteered to test this application for me.

Footnotes

While SpaceSiren was designed to run as cheaply as possible, even for individuals, it will not be entirely free of operating costs. You will incur nominal costs for DynamoDB, Lambda, API Gateway, Route 53, and perhaps CloudTrail, depending on your configuration. You should expect to spend between $1 and $5 per month to run SpaceSiren. Of course, the project's maintainers are not responsible for any actual costs you incur. Please closely monitor your AWS bill while it is in use.

You might also like...

Remote control your Greenbone Vulnerability Manager (GVM)

Greenbone Vulnerability Management Tools The Greenbone Vulnerability Management Tools gvm-tools are a collection of tools that help with remote contro

130 Dec 17, 2022

Encrypted Python Password Manager

PyPassKeep Encrypted Python Password Manager About PyPassKeep (PPK for short) is an encrypted python password manager used to secure your passwords fr

1 Nov 17, 2021

Password-Manager GUI

PASSWORD-MANAGER This repo contains all the project files. Project Description A Tkinter GUI that allows you to store website info like website name,

1 Dec 8, 2021

PassLock is a medium-security password manager that encrypts passwords using Advanced Encryption Standards (AES)

A medium security python password manager that encrypt passwords using Advanced Encryption Standard (AES) PassLock is a password manager and password

44 Nov 18, 2022

🔐 A simple command-line password manager.

PassVault What Is It? It is a command-line password manager, for educational purposes, that stores localy, in AES encryption, your sensitives datas in

5 Aug 15, 2022

This is a Cryptographied Password Manager, a tool for storing Passwords in a Secure way

Cryptographied Password Manager This is a Cryptographied Password Manager, a tool for storing Passwords in a Secure way without using external Service

3 Nov 23, 2022

Providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account.

We are providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account. The script enables security teams to identify external-facing AWS assets by running the exploit on them, and thus be able to map them and quickly patch them

13 Jan 4, 2022

Wonk is a tool for combining a set of AWS policy files into smaller compiled policy sets.

140 Dec 16, 2022

Security offerings for AWS Control Tower

Caylent Security Catalyst Reference Architecture Examples This repository contains solutions for Caylent's Security Catalyst. The Security Catalyst is

1 Oct 22, 2021

Comments

Multiple alert email addresses

Allow for more than one destination email address for alerts. Terraform should take a list of email addresses. They will all need to be verified in SES.

opened by khicks 0
Enhancement/Canary Resources scaffolding
Add support for canary resources:

This is the initial scaffolding, that adds an endpoint to monitor activity for given resource ARNs.

Under the current format, it only supports resources in the account where spacesiren is deployed

Will have to look into the best way to monitor arbitrary trails

TODOs:

[ ] Update documentation for the new endpoint
opened by x4v13r64 0

Releases(1.4.0)

1.4.0(Dec 19, 2021)
IMPROVEMENTS:

Update Terraform to version 1.1.2.

Provider dependency upgrades.

Source code(tar.gz)
Source code(zip)
1.3.0(Apr 15, 2021)
IMPROVEMENTS:

Update Terraform to version 0.15.

Source code(tar.gz)
Source code(zip)
1.2.1(Aug 23, 2020)
IMPROVEMENTS:

Update AWS provider to 3.3.0.

BUG FIXES:

Lambda logging permissions with the new aws_cloudwatch_log_group ARN format.

Source code(tar.gz)
Source code(zip)
1.2.0(Aug 15, 2020)
FEATURES:

Pushover support. New tfvars are alert_pushover_user_key and alert_pushover_api_key.

Test alert API endpoint: /test-alert.

IMPROVEMENTS:

Remove trimsuffix from Route 53 zone name.

Source code(tar.gz)
Source code(zip)
1.1.0(Aug 14, 2020)
IMPROVEMENTS:

Artwork!

Change directory structure. Terraform code now has its own directory.

If you previously had SpaceSiren set up, delete your functions-pkg/ directory and move the following files/dirs to the terraform/ directory:

.terraform/

terraform-local.tf

terraform.tfvars

Source code(tar.gz)
Source code(zip)
1.0.0(Aug 14, 2020)

Source code(tar.gz)
Source code(zip)

Owner

GitHub Repository

Metasploit Multi Purpose Exploiting Toolkit For Termux

MSF-EXPLOIT MSF-ANDRO is a Metasploit Multi Purpose Exploiting Toolkit For Termux . Only a Basic Script , Still in Development . FEATURES : Install Me

22 Dec 29, 2022

A Burp Pro extension that adds log4shell checks to Burp Scanner

scan4log4shell A Burp Pro extension that adds log4shell checks to Burp Scanner, written by Daniel Crowley of IBM X-Force Red. Installation To install

26 Mar 15, 2022

Omega - From Wordpress admin to pty

The Linux tool to automate the process of getting a pty once you got admin credentials in a Wordpress site. Keep in mind that right now Omega only can attack Linux hosts.

12 Nov 09, 2022

CVE-2021-44228 log4j 2.x rce漏洞检测工具

#1 使用说明 CVE-2021-44228 log4j 2.x rce漏洞检测工具，对目标链接发起get请求并利用dnslog探测是否有回显 $ python3 log4j-scan.py -h

4 Jan 13, 2022

MainCoon - an automated recon framework

MainCoon is an automated recon framework meant for gathering information during penetration testing of web applications.

8 Aug 26, 2022

STATS305C: Applied Statistics III (Spring, 2022)

STATS305C: Applied Statistics III Instructor: Scott Linderman TA: Matt MacKay, James Yang Term: Spring 2022 Stanford University Course Description: Pr

14 Aug 11, 2022

labsecurity is a framework and its use is for ethical hacking and computer security

labsecurity labsecurity is a framework and its use is for ethical hacking and computer security. Warning This tool is only for educational purpose. If

16 Dec 08, 2022

This is a simple Port Flooder written in Python 3.

This is a simple Port Flooder written in Python 3. Use this tool to quickly stress test your network devices and measure your router's or server's load.

4 Feb 20, 2022

an impacket-dependent script exploiting CVE-2019-1040

dcpwn an impacket-dependent script exploiting CVE-2019-1040, with code partly borrowed from those security researchers that I'd like to say thanks to.

71 Nov 30, 2022

A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF.

TProxer A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF. How • Install • Todo • Join Discord How it works

162 Nov 25, 2022

Nmap automated port scanner written in Python

port-scanner Nmap automated port scanner written in Python. USE: Clone the module Import the module: from portscanModule import portscanner Use: ports

1 Dec 03, 2021

Recon is a script to perform a full recon on a target with the main tools to search for vulnerabilities.

👑 Recon 👑 The step of recognizing a target in both Bug Bounties and Pentest can be very time-consuming. Thinking about it, I decided to create my ow

171 Dec 31, 2022

Infection Monkey - An automated pentest tool

Infection Monkey Data center Security Testing Tool Welcome to the Infection Monkey! The Infection Monkey is an open source security tool for testing a

6k Jan 09, 2023

Scan Site - Tools For Scanning Any Site and Get Site Information

Site Scanner Tools For Scanning Any Site and Get Site Information Example Require - pip install colorama - pip install requests How To Use Download Th

5 Mar 19, 2022

A hashtag check python module

3 Aug 10, 2022

Local server for IDA Lumina feature

About POC of an offline server for IDA Lumina feature.

166 Dec 30, 2022

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

DOME - A subdomain enumeration tool Check the Spanish Version Dome is a fast and reliable python script that makes active and/or passive scan to obtai

329 Jan 01, 2023