$ show atredispartners/flamingo
Flamingo is a Go-based credential capture honeypot that listens on multiple network protocols (SSH, HTTP, LDAP, DNS, FTP, SNMP) to intercept authentication attempts from automated scanners, malware, and misconfigured devices. It presents fake service banners and responds to authentication challenges, logging credentials (passwords, NTLM hashes, SSH keys, SNMP community strings) to configurable outputs including stdout, files, webhooks, and syslog. The architecture uses a concurrent record writer pattern: each protocol handler runs as a goroutine, capturing credentials into a buffered channel that feeds multiple output sinks. The code is well-structured with clean separation of protocol handlers, configuration via Cobra CLI flags, and self-signed TLS certificate generation. While the core credential capture logic is tightly coupled to the specific challenge values (e.g., hardcoded NTLM challenge), the output dispatching and port parsing components are extractable. The repository includes vendored LDAP server and ASN.1 BER libraries with modifications.
The LLM identified 3 files worth highlighting for reuse:
Implements a generic RecordWriter with a buffered channel that accepts credential records and dispatches them to multiple output writers concurrently. The OutputWriter and OutputCleaner function types allow clean separation of writing logic (file, webhook, syslog, stdout). The pattern is reusable for any application that needs to asynchronously fan-out data to multiple destinations with graceful shutdown.
CrackPorts function parses comma-separated port specifications that support individual ports, ranges (e.g., 80-100), and deduplication. It returns a sorted list of valid ports. This is a self-contained utility that can be extracted and reused in any Go tool requiring flexible port input parsing, with clean error handling and range validation.
Provides low-level parsing of NTLMSSP challenge blobs, extracting fields like target name, version, DNS computer/domain names, and timestamps using manual binary parsing without external dependencies. This code is reusable for any Go project that needs to decode NTLM challenges for security analysis or audit logging, independent of the rest of Flamingo.