# Testing & Validation This guide explains how to **validate a TrapEye deployment** by generating controlled interactions against a deployed TrapEye device. These tests simulate common attacker techniques to validate TrapEye operation, traffic capture, and alert visibility. --- ## Prerequisites Before starting, ensure that: - At least **one TrapEye device** is deployed and visible in the **Devices** section - The TrapEye device appears **online** - A policy **enabling the services to be tested** is applied to the TrapEye device - A testing machine with shell access, **on the same network** as the TrapEye device, is available --- ## Where to Observe Results All tests below will generate **Interactions** that can be viewed in **Detection → Interactions**. Each interaction includes attacker fingerprinting, protocol metadata, and payload details. --- ## Network Discovery Detection (Nmap) TrapEye detects common reconnaissance activity at the network layer. **Caution:** Nmap is an **offensive security tool** that may be flagged or blocked by antivirus/EDR solutions. You may need to add an exclusion or temporarily disable security software on the testing machine. ```bash sudo apt install nmap ``` ```bash brew install nmap ``` [Download Nmap](https://nmap.org/download) 1. From a machine on the same network, run a port scan against the TrapEye IP: ```bash nmap -Pn -sS ``` **Flag details:** * `-Pn`: **No Ping**. Treats the host as online and skips discovery. Useful if ICMP is blocked or to ensure the scan proceeds regardless of reachability checks. * `-sS`: **SYN Stealth Scan**. This "half-open" scan sends a SYN packet and waits for a response but never completes the 3-way handshake. It is faster and often stealthier. Or for a TCP Connect scan (if you don't have root privileges): ```bash nmap -Pn -sT -p 21,22,80,443,3389 ``` * `-sT`: **TCP Connect Scan**. This scan performs a full 3-way handshake (SYN, SYN/ACK, ACK) for every port. It is used when raw packet privileges are not available. * `-p`: **Port Specification**. Scans only the specified ports (e.g., FTP, SSH, HTTP, HTTPS, RDP) instead of the default 1000 most common ports. **Expected Result** - A **Port Scan Interaction** is generated - Source IP, scan type, ports, and timing are visible in the TrapEye console - A Threat may be created if this is the first interaction from the source IP --- ## FTP Interaction Detection TrapEye emulates FTP services to capture attacker behavior. **Caution:** **FTP Passive Mode Ports** If a firewall manages port opening, ports **50000-50010** must be open for the FTP service to function correctly in passive mode. ```bash sudo apt install inetutils-ftp ``` Built-in `ftp` command. Built-in `ftp` command. 1. Connect to the TrapEye device using FTP: ```bash ftp ``` 2. Use common FTP commands: ```bash USER anonymous PASS test ls mkdir test_dir put localfile.txt get id_ed25519 ``` **Expected Result** - Each command generates an **Interaction** - Uploaded/downloaded file metadata is recorded --- ## SSH Interaction Detection TrapEye detects SSH authentication attempts and interactive sessions. **Note:** If the sandbox feature is enabled in the interface, TrapEye will log all executed commands and provide an interactive shell to the attacker. ```bash sudo apt install openssh-client ``` Built-in `ssh` command. Built-in OpenSSH Client (Windows 10/11) or PuTTY. 1. Attempt an SSH connection: ```bash ssh root@ ``` 2. Enter any password when prompted **Expected Result** - Authentication attempts are recorded - Username, source IP, client fingerprint, and timing are visible - Interactive shell commands generate additional interactions if authentication is successful --- ## Telnet Interaction Detection TrapEye detects Telnet connection and authentication attempts. ```bash sudo apt install telnet ``` 1. Connect to the TrapEye device using Telnet: ```bash telnet ``` 2. Enter credentials when prompted (any username and password). 3. Type a command (e.g., `whoami`, `ls`, `pwd`) in the interactive session. ```bash brew install telnet ``` 1. Connect to the TrapEye device using Telnet: ```bash telnet ``` 2. Enter credentials when prompted (any username and password). 3. Type a command (e.g., `whoami`, `ls`, `pwd`) in the interactive session. Enable Telnet Client via **Windows Features**. 1. Connect to the TrapEye device using Telnet: ```cmd telnet ``` 2. Enter credentials when prompted (any username and password). 3. Type a command (e.g., `whoami`, `dir`, `cd`) in the interactive session. 1. Clone the exploit repository: ```bash git clone https://github.com/SafeBreach-Labs/CVE-2026-24061.git cd CVE-2026-24061 ``` 2. Run the Telnet RCE exploit: ```bash python telnet_rce.py -p ``` 3. Type a command (e.g., `whoami`, `ls`, `pwd`) in the interactive session. **Expected Result** - Telnet connection and authentication attempts are recorded - CVE-2026-24061 exploitation technique is fingerprinted - TrapEye logs initial command, instant client-side termination --- ## SMTP Interaction Detection TrapEye simulates SMTP services to capture email-based attacks. ```bash sudo apt install swaks ``` ```bash brew install swaks ``` [Download Swaks](http://jetmore.org/john/code/swaks/) 1. Send a simulated email with authentication using `swaks`: ```bash swaks --server : \ --ehlo client.example.com \ --auth LOGIN \ --auth-user "admin" \ --auth-password "admin" \ --from "admin@example.com" \ --to "recipient@example.com" \ --header "Subject: Test SEND MAIL" \ --body "Content of test email generated with swaks." ``` **Expected Result** - SMTP commands are logged as interactions - Sender, recipient, and payload metadata are captured --- ## HTTP Interaction Detection TrapEye detects web traffic and fingerprints the visiting browser. 1. Open a web browser (Chrome, Firefox, Safari). 2. Navigate to the TrapEye IP address: ```text http:// ``` **Expected Result** - An **Interaction** is generated - Browser fingerprinting (User-Agent, headers) is visible --- ## LDAP Interaction Detection TrapEye detects LDAP enumeration attempts. ```bash sudo apt install ldap-utils ``` ```bash brew install openldap ``` 1. Run an LDAP search against the TrapEye device: ```bash ldapsearch -LLL -x \ -H ldap://: \ -D "user@example.com" \ -w "Password123" \ -b "DC=example,DC=com" \ "(&(whenChanged>=20250125000000.0Z))" \ sAMAccountName whenChanged ``` **Expected Result** - LDAP query is logged as an interaction - Search filter and base DN are captured --- ## Modbus Interaction Detection TrapEye detects Modbus protocol interactions commonly used in industrial control systems (ICS/SCADA). 1. Clone the SMOD repository: ```bash git clone https://github.com/Joshua1909/smod.git cd smod ``` 2. Run SMOD using Docker with Python 2.7: ```bash docker run -it --rm \ -v "$(pwd):/app" \ -w /app \ python:2.7 \ python smod.py ``` 3. Use the Modbus read coils function: ```text SMOD >use modbus/function/readCoils SMOD modbus(readCoils) >show options SMOD modbus(readCoils) >set RHOSTS SMOD modbus(readCoils) >set UID SMOD modbus(readCoils) >exploit ``` **Expected Result** - Modbus connection and query attempts are recorded - Function codes, unit IDs, and register addresses are captured - Response data from TrapEye Modbus emulation is visible --- ## RDP Interaction Detection TrapEye detects unauthorized RDP connection attempts. 1. Install and connect using `xfreerdp3`: ```bash sudo apt install freerdp3-x11 xvfb xvfb-run -a xfreerdp3 /v: /u:administrator /d:test.local ``` Download [Microsoft Remote Desktop](https://apps.apple.com/us/app/microsoft-remote-desktop/id1295203466) 1. Open **Microsoft Remote Desktop**. 2. Add a new PC with the specific IP ``. 3. Connect and attempt to log in as `Administrator`. Built-in Remote Desktop Connection. 1. Open **Remote Desktop Connection**. 2. Enter the IP address ``. 3. Click Connect and attempt authentication. **Expected Result** - RDP handshake and authentication attempts are recorded - Source system fingerprinting is visible --- ## PostgreSQL Interaction Detection TrapEye detects authentication attempts on PostgreSQL services. ```bash sudo apt install postgresql-client ``` ```bash brew install libpq ``` 1. Attempt to connect to the PostgreSQL service: ```bash psql -h -p 5432 -U admin -d dbtest -W ``` 2. Enter any password when prompted. **Expected Result** - Connection attempt and credentials are recorded - Database name and username are captured --- ## Brute Force Detection TrapEye detects and correlates repeated authentication failures to identify brute-force attacks. ```bash sudo apt install medusa ``` 1. Download a common password list (e.g., SecLists): ```bash wget https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Common-Credentials/darkweb2017_top-100.txt -O darkweb2017_top-100.txt ``` 2. Run a brute-force attack using Medusa: ```bash medusa -h -n -u root -P darkweb2017_top-100.txt -M ssh -t 5 ``` **Expected Result** - 5 authentication failures are logged, followed by a **Brute Force** interaction including the number of attempts --- ## Next Steps Once validation is complete, you can: - Integrate TrapEye alerts into your **SIEM** and build **SOAR playbooks** for automated response - Scale the deployment with additional TrapEye devices