Comments (7)
shortstack
commented on August 22, 2024
1
well.
it's working.
i had reverted my changes (before this issue was created) because i was waiting for my PR that is now applied and in place, the one that adds region/output to the AWS data on the manage screen.
so when the callbacks hit, region and output were not in canarydrop.py. and they are there now because i pulled my changes in the other day. and it's working.
omg.
from canarytokens.
commented on August 22, 2024
Hey @shortstack,
Im on it. Ill ping you back soon with some more information.
from canarytokens.
commented on August 22, 2024
Hey @shortstack,
Found the issue and going to be pushing a fix + new canarytokens docker images shortly.
Thanks again (again!)
from canarytokens.
shortstack
commented on August 22, 2024
thank YOU!!! :)
from canarytokens.
shortstack
commented on August 22, 2024
k, i pulled channel_dns.py and applied your changes, ran the AWS CLI commands again, still getting the following:
2018-12-14 15:02:09+0000 [-] query=Query('GU2C4MRTGYXDCMBXFYYTAOA8.MF3XGLLDNRUS6MJOGE3C4NZTEBIHS5DIN5XC6MROG4XDCMRAJRUW45LYF42C4NB.OGAWTCMBWGEWWC53TEBRG65DPMNXXEZJPGEXDCMROGYZQ8888.A321.yg52b6n5nq17cssbfjfuo59rj.rdp.domain.com', 28, 1),src_ip='18.222.193.179'
2018-12-14 15:02:10+0000 [-] query=Query('gu2c4mrtgyxdcmbxfyytaoa8.mf3xglldnrus6mjoge3c4nztebihs5din5xc6mrog4xdcmrajruw45lyf42c4nb.ogawtcmbwgewwc53tebrg65dpmnxxezjpgexdcmrogyzq8888.a321.yg52b6n5nq17cssbfjfuo59rj.rdp.domain.com', 28, 1),src_ip='18.217.117.36'
2018-12-14 15:02:10+0000 [-] query=Query('ns1.domain.com', 28, 1),src_ip='18.217.117.36'
2018-12-14 15:02:10+0000 [-] query=Query('ns2.domain.com', 28, 1),src_ip='18.217.117.36'
2018-12-14 15:02:10+0000 [-] query=Query('ns1.domain.com', 28, 1),src_ip='18.217.117.36'
2018-12-14 15:02:10+0000 [-] query=Query('ns2.domain.com', 28, 1),src_ip='18.217.117.36'
2018-12-14 15:02:10+0000 [-] query=Query('gu2c4mrtgyxdcmbxfyytaoa8.mf3xglldnrus6mjoge3c4nztebihs5din5xc6mrog4xdcmrajruw45lyf42c4nb.ogawtcmbwgewwc53tebrg65dpmnxxezjpgexdcmrogyzq8888.a321.yg52b6n5nq17cssbfjfuo59rj.rdp.domain.com', 28, 1),src_ip='18.217.117.36'
2018-12-14 15:02:10+0000 [-] query=Query('gu2c4mrtgyxdcmbxfyytaoa8.mf3xglldnrus6mjoge3c4nztebihs5din5xc6mrog4xdcmrajruw45lyf42c4nb.ogawtcmbwgewwc53tebrg65dpmnxxezjpgexdcmrogyzq8888.a321.yg52b6n5nq17cssbfjfuo59rj.rdp.domain.com', 1, 1),src_ip='18.217.117.36'
2018-12-14 15:02:10+0000 [DNSDatagramProtocol (UDP)] Unhandled Error
Traceback (most recent call last):
Failure: exception.UnknownAttribute:
2018-12-14 15:04:22+0000 [-] query=Query('ns2.domain.com', 28, 1),src_ip='18.222.94.62'
2018-12-14 15:04:22+0000 [-] query=Query('ns1.domain.com', 28, 1),src_ip='18.222.94.62'
2018-12-14 15:04:22+0000 [-] query=Query('GU2C4MRTGYXDCMBXFYYTAOA8.MF3XGLLDNRUS6MJOGE3C4NZTEBIHS5DIN5XC6MROG4XDCMRAJRUW45LYF42C4NB.OGAWTCMBWGEWWC53TEBRG65DPMNXXEZJPGEXDCMROGYZQ8888.A990.yg52b6n5nq17cssbfjfuo59rj.rdp.domain.com', 28, 1),src_ip='18.222.94.62'
2018-12-14 15:04:22+0000 [-] query=Query('ns1.domain.com', 28, 1),src_ip='18.221.66.220'
2018-12-14 15:04:22+0000 [-] query=Query('ns2.domain.com', 28, 1),src_ip='18.221.66.220'
2018-12-14 15:04:22+0000 [-] query=Query('GU2C4MRTGYXDCMBXFYYTAOA8.MF3XGLLDNRUS6MJOGE3C4NZTEBIHS5DIN5XC6MROG4XDCMRAJRUW45LYF42C4NB.OGAWTCMBWGEWWC53TEBRG65DPMNXXEZJPGEXDCMROGYZQ8888.A990.yg52b6n5nq17cssbfjfuo59rj.rdp.domain.com', 1, 1),src_ip='18.221.66.220'
2018-12-14 15:04:22+0000 [DNSDatagramProtocol (UDP)] Unhandled Error
Traceback (most recent call last):
Failure: exception.UnknownAttribute:
2018-12-14 15:04:22+0000 [-] query=Query('ns1.domain.com', 28, 1),src_ip='18.222.94.62'
2018-12-14 15:04:22+0000 [-] query=Query('ns1.domain.com', 28, 1),src_ip='18.221.66.220'
2018-12-14 15:04:22+0000 [-] query=Query('ns2.domain.com', 28, 1),src_ip='18.221.66.220'
2018-12-14 15:04:22+0000 [-] query=Query('ns2.domain.com', 28, 1),src_ip='18.222.94.62'
2018-12-14 15:04:22+0000 [-] query=Query('GU2C4MRTGYXDCMBXFYYTAOA8.MF3XGLLDNRUS6MJOGE3C4NZTEBIHS5DIN5XC6MROG4XDCMRAJRUW45LYF42C4NB.OGAWTCMBWGEWWC53TEBRG65DPMNXXEZJPGEXDCMROGYZQ8888.A990.yg52b6n5nq17cssbfjfuo59rj.rdp.domain.com', 1, 1),src_ip='18.221.66.220'
2018-12-14 15:04:22+0000 [DNSDatagramProtocol (UDP)] Unhandled Error
Traceback (most recent call last):
Failure: exception.UnknownAttribute:
2018-12-14 15:04:22+0000 [-] query=Query('GU2C4MRTGYXDCMBXFYYTAOA8.MF3XGLLDNRUS6MJOGE3C4NZTEBIHS5DIN5XC6MROG4XDCMRAJRUW45LYF42C4NB.OGAWTCMBWGEWWC53TEBRG65DPMNXXEZJPGEXDCMROGYZQ8888.A990.yg52b6n5nq17cssbfjfuo59rj.rdp.domain.com', 28, 1),src_ip='18.222.94.62'
2018-12-14 15:04:22+0000 [-] query=Query('ns1.domain.com', 28, 1),src_ip='18.219.130.167'
2018-12-14 15:04:22+0000 [-] query=Query('ns1.domain.com', 28, 1),src_ip='13.58.26.49'
2018-12-14 15:04:22+0000 [-] query=Query('ns2.domain.com', 28, 1),src_ip='18.219.130.167'
2018-12-14 15:04:22+0000 [-] query=Query('ns2.domain.com', 28, 1),src_ip='13.58.26.49'
2018-12-14 15:04:22+0000 [-] query=Query('gu2c4mrtgyxdcmbxfyytaoa8.mf3xglldnrus6mjoge3c4nztebihs5din5xc6mrog4xdcmrajruw45lyf42c4nb.ogawtcmbwgewwc53tebrg65dpmnxxezjpgexdcmrogyzq8888.a990.yg52b6n5nq17cssbfjfuo59rj.rdp.domain.com', 1, 1),src_ip='18.219.130.167'
2018-12-14 15:04:22+0000 [DNSDatagramProtocol (UDP)] Unhandled Error
Traceback (most recent call last):
Failure: exception.UnknownAttribute:
from canarytokens.
commented on August 22, 2024
Hey @shortstack,
I am battling to reproduce the error you are having there. I have tried both DNS and AWS tokens (and even tried the query you pasted above). All seem to be working.
Is there any other setup information you can give me that may help? The exception we seeing there isn't super helpful either. It may be worth adding some extra debugging lines to try see where in that DNS code path it is breaking.
Another suggestion: so since that Exception is triggered from the canarydrop.py file, you could maybe check in redis what that Canarydrop looks like and try spot the attribute that may be causing the exception i.e. not in the list in canarydrop.py called allowed_attrs.
In the meantime, ill try reproduce the exception you are experiencing. Please let me know how it goes.
from canarytokens.
commented on August 22, 2024
Haha im glad its working!
from canarytokens.
Related Issues (20)
- Thwarting Malware HOT 2
- Support Wildcard CORS Headers HOT 9
- Credit Card token (beta) not working HOT 3
- EH HOT 1
- [BUG] "Sensitive command hostname" & "Sensitive command username" or "Sensitive Command Information" missing from alerts HOT 9
- Ability to trigger token based on user
- [BUG] Web bug token serves images with html header HOT 1
- mail HOT 3
- Phone hack HOT 1
- Discord Webhook Support HOT 4
- [BUG] "An error has occurred: Internal Server Error" message when trying to create a credit card token HOT 6
- [BUG] error webhook sent with wrong content-type HOT 1
- Enable wildcard CORS support HOT 12
- [BUG] Unable to add Azure Logic App Webhook URL HOT 4
- [BUG] Microsoft Teams Webhook not functioning HOT 1
- Support IP2Location.io API HOT 4
- [BUG] AWS Keys will not generate with webhook or email HOT 1
- Windows folder token not working HOT 7
- Exploit - CSV Injection HOT 3
- [BUG] Invalid Canarytoken triggered alerts received HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from canarytokens.