Honeypot Security Node

🛡️ Honeypot Threat Intelligence Control

🔒 Unauthorized Access: Invalid Password Token Provided.

\n \n

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n

Timestamp	Attacker IP	Session Tracking ID	Action & Target Path	Classification	Payload
Awaiting secure cryptographic handshake...

\n\n \n \n \n `;\n return new Response(interfaceHtml, {\n headers: { \"Content-Type\": \"text/html\" },\n });\n }\n\n // 3. EXTRACT INBOUND PAYLOADS FROM PROBES\n let payloadBody = \"\";\n if (method === \"POST\" || method === \"PUT\" || method === \"PATCH\") {\n try {\n payloadBody = await req.text();\n } catch {\n payloadBody = \"[Unparseable]\";\n }\n }\n\n const ip = req.headers.get(\"x-forwarded-for\") || \"unknown\";\n const ua = req.headers.get(\"user-agent\") || \"unknown\";\n const timestamp = new Date().toISOString();\n\n // 4. INTELLIGENT THREAT SIGNATURE FINGERPRINTING\n let attackType = \"Reconnaissance\";\n const combinedData = (url.pathname + url.search + payloadBody).toLowerCase();\n\n if (/union\\s+select|select\\s+.*\\s+from|drop\\s+table/i.test(combinedData)) {\n attackType = \"SQL Injection (SQLi)\";\n } else if (/\n url.pathname.toLowerCase().includes(v)\n )\n ) {\n attackType = \"Known Vulnerability Scan\";\n }\n\n // 5. ATTACKER SESSION COOKIE TRACKING\n const cookieHeader = req.headers.get(\"cookie\") || \"\";\n let sessionId = cookieHeader.match(/__htid=([^;]+)/)?.[1];\n let isNewSession = false;\n\n if (!sessionId) {\n sessionId = crypto.randomUUID();\n isNewSession = true;\n }\n\n // Commit transaction log directly to SQLite\n await sqlite.execute({\n sql:\n `INSERT INTO enterprise_honeypot_logs (timestamp, ip, ua, path, method, payload, attack_type, session_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n timestamp,\n ip,\n ua,\n url.pathname,\n method,\n payloadBody,\n attackType,\n sessionId,\n ],\n });\n\n // 6. PIPELINE EMAIL ALERT RULES\n if (attackType !== \"Reconnaissance\" || method === \"POST\") {\n try {\n await email({\n subject: `⚠️ HONEYPOT ALERT: ${attackType} Detected`,\n text:\n `Threat Signature Isolated:\\n\\nType: ${attackType}\\nSession ID: ${sessionId}\\nIP: ${ip}\\nPath: [${method}] ${url.pathname}\\nPayload: ${payloadBody}`,\n });\n } catch (e) {\n console.error(e.message);\n }\n }\n\n // 7. DECEPTIVE SIMULATION BREAK: Respond & Drop Tracking Cookie\n const responseHeaders = new Headers({\n \"Content-Type\": \"application/json\",\n });\n if (isNewSession) {\n responseHeaders.append(\n \"Set-Cookie\",\n `__htid=${sessionId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000`,\n );\n }\n\n return new Response(\n JSON.stringify({\n error: \"SystemIntegrityFault\",\n status: 500,\n incident_id: crypto.randomUUID().substring(0, 8),\n }),\n { status: 500, headers: responseHeaders },\n );\n}","deleted","label",[115],"58db04e7-b7d0-40d8-9d2b-86c7b2267488","new-file-4768.ts",9,["D",1788839612678],6,"import axios from \"npm:axios\";\n\nexport default async function (req: Request) {\n const urlParams = new URL(req.url).searchParams;\n const targetUrl = urlParams.get(\"target\");\n\n // If a target URL is provided, run the security audit\n if (targetUrl) {\n try {\n // Validate that it's a properly formatted URL\n new URL(targetUrl);\n } catch {\n return new Response(\n \"Invalid URL format. Please include http:// or https://\",\n { status: 400 },\n );\n }\n\n const REQUEST_COUNT = 50;\n const promises = Array.from({ length: REQUEST_COUNT }).map(\n async (_, index) => {\n try {\n const startTime = Date.now();\n const response = await axios.get(targetUrl, {\n timeout: 4000,\n headers: { \"User-Agent\": \"ValTown-WAF-Auditor-Bot/1.0\" },\n });\n return {\n id: index + 1,\n status: response.status,\n time: Date.now() - startTime,\n };\n } catch (error) {\n return {\n id: index + 1,\n status: error.response?.status || \"TIMEOUT/BLOCKED\",\n time: 0,\n };\n }\n },\n );\n\n const rawResults = await Promise.all(promises);\n\n // Aggregate data points for visualization\n const statusCounts: Record = {};\n rawResults.forEach((r) => {\n statusCounts[r.status] = (statusCounts[r.status] || 0) + 1;\n });\n\n // Generate HTML report with an embedded chart layout placeholder\n const htmlReport = `\n \n \n \n Audit Results: ${targetUrl}\n \n \n \n

WAF & Rate-Limit Audit Report

Target: ${targetUrl}

\n \n

Summary Status Distribution

If the site successfully blocked the burst, you should see many 429 (Too Many Requests) or connection drop failures.

Status ${status}: ${count} requests

\n\n

Raw Sequence Logs

\n \n \n ${\n rawResults.map((r) => `\n \n \n \n \n \n `).join(\"\")\n }\n

Request #	HTTP Status Code	Latency
${r.id}	${r.status}	${r.time > 0 ? `${r.time}ms` : \"N/A\"}

\n
\n ← Test Another Site\n \n \n `;\n\n return new Response(htmlReport, {\n headers: { \"Content-Type\": \"text/html\" },\n });\n }\n\n // Default Form Interface View\n const initialFormHtml = `\n \n \n \n Ethical Hacking: WAF Tester\n \n \n \n

🛡️ Rate-Limit & WAF Stress Auditor

Simulate an automated credential stuffing or aggressive scanning request burst against your site.

\n \n

\n ⚠️ Ethical Hacking Notice: Only target web assets that you personally own or have explicit written authorization to test. Unauthorized automated scanning can trigger security alerts or hosting dynamic overage fees.\n

\n\n \n \n \n `;\n\n return new Response(initialFormHtml, {\n headers: { \"Content-Type\": \"text/html\" },\n });\n}",[132],"4f619459-897b-4d12-afbd-b08608068197","main.ts","b433ef8e-ab37-11f1-a99e-1607ee4eb77e",2,["D",1788839121779],1,"script","import axios from \"npm:axios\";\n\nexport default async function (req: Request) {\n // Specify an endpoint on your OWN website to test\n const TARGET_URL = \"https://your-own-website-domain.com\";\n const REQUEST_COUNT = 10;\n\n const promises = Array.from({ length: REQUEST_COUNT }).map(\n async (_, index) => {\n try {\n const startTime = Date.now();\n const response = await axios.get(TARGET_URL, {\n timeout: 3000,\n headers: { \"User-Agent\": \"ValTown-Security-Audit-Bot\" },\n });\n return {\n req: index + 1,\n status: response.status,\n duration: `${Date.now() - startTime}ms`,\n };\n } catch (error) {\n return {\n req: index + 1,\n status: error.response?.status || \"TIMED_OUT\",\n message: error.message,\n };\n }\n },\n );\n\n const results = await Promise.all(promises);\n\n // Count how many requests were blocked (e.g., 429 Too Many Requests) vs how many succeeded (200 OK)\n return Response.json({\n message: \"Rate-limit audit complete.\",\n results,\n });\n}",[139],"pulls","branches","forks","envVars",{"_154":42,"_156":42},"connections",{"_154":42,"_155":42},"count","unfilledCount","emptyCount",{"_18":138,"_20":139,"_116":140,"_118":-5,"_119":71,"_120":141,"_121":38,"_22":167,"_68":143,"_124":144,"_126":145,"_128":26,"_129":-5,"_161":168,"_89":169},{"_18":131,"_20":132,"_116":36,"_118":-5,"_119":71,"_120":133,"_121":38,"_22":164,"_68":135,"_124":125,"_126":136,"_128":26,"_129":21,"_161":165,"_89":166},{"_18":114,"_20":115,"_116":117,"_118":-5,"_119":71,"_120":69,"_121":38,"_22":160,"_68":123,"_124":125,"_126":127,"_128":26,"_129":-5,"_161":162,"_89":163},["D",1788840832819],"children",[],[115],["D",1788839612678],[],[132],["D",1788839121779],[],[139],["D",1788839115838],["D",1789448471428],{"_16":17,"_87":83},{"_16":17,"_80":81,"_82":83,"_33":34,"_84":85,"_86":26},{"_68":69,"_20":70,"_18":71,"_72":19,"_73":-5,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":21,"_79":17},"ctx",{"_61":-5,"_108":208,"_209":210,"_211":212,"_213":26,"_214":26,"_215":26,"_216":38,"_217":-5,"_218":-7,"_219":-7,"_220":42,"_221":26,"_222":26,"_223":-5,"_224":26,"_225":26,"_226":26,"_227":-5},"ENV",{"_179":180,"_181":182,"_183":70,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Search