Return appropriate return codes based on responses

[gudlyf]

If, for example, galah is returning a redirect response, it should return the appropriate return code (bonus: make return codes other than 200 optional).

Current behavior:

curl -i http://localhost:8080/wp-admin/
HTTP/1.1 200 OK
Connection: keep-alive
Location: http://localhost:8080/wp-login.php?redirect_to=http%3A%2F%2Flocalhost%3A8080%2Fwp-admin%2F&reauth=1
Server: Apache/2.4.1 (Unix)
Date: Mon, 22 Jan 2024 16:51:24 GMT
Content-Length: 0

Changed behavior:

curl -i http://localhost:8080/wp-admin/
HTTP/1.1 302 Moved Temporarily
Connection: keep-alive
Location: http://localhost:8080/wp-login.php?redirect_to=http%3A%2F%2Flocalhost%3A8080%2Fwp-admin%2F&reauth=1
Server: Apache/2.4.1 (Unix)
Date: Mon, 22 Jan 2024 16:51:24 GMT
Content-Length: 0

[0x4D31]

@gudlyf, Thanks for submitting the issue. Now I know that at least someone has tried the tool. :) I'll work on it.

[Jeymz]

@gudlyf, Thanks for submitting the issue. Now I know that at least someone has tried the tool. :) I'll work on it.

@gudlyf, Thanks for submitting the issue. Now I know that at least someone has tried the tool. :) I'll work on it.

Not sure if this helps or not but I was experimenting with some alternate queries and found this one to be relatively consistent. This would enable to llm to respond with necessary information to deliver proper

You are a helpful assistant that acts as a honeypot for a web application.
Your goal is to craft convincing and luring simulated responses using the request details that will be sent back to the potential attacker and result in additional data being collected about potential attackers and their attack practices.
You will respond to all queries in the following format:

{
  "request": {
    "hostname": "queencitycon.org",
    "path": "/.aws/credentials",
    "userAgent":"Go-http-client/1.1",
    "method": "GET"
  },
  "response": {
    "statusCode": 200,
    "format": "text",
    "data": "[default]\naws_access_key_id = AKIAJKBXWSGIORDVHQZA\naws_secret_access_key = 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\n[MyAdmin]\naws_access_key_id = AKIAIALZKM6IUQACVF2Q\naws_secret_access_key = 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"
  }
  "vulnerability": {
    "cwe": 200
    "name": "Exposure of Sensitive Information to an Unauthorized Actor",
    "details": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."
  },
  "scanOrExploit": "EXPLOIT",
  "confidence": 10,
  "additionalInformation": "This crafted response is designed to appear as if the requested path \"/.aws/credentials\" on \"queencitycon.org\" has successfully exposed AWS credentials, thereby validating the attacker's scan or exploit attempt."
}