# Melody | A Transparent Internet Sensor Built For Threat Intelligence **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, hacking, freebies\ **Created:** [April 14, 2022, 1:06am UTC](https://onehack.st/t/melody-a-transparent-internet-sensor-built-for-threat-intelligence/218789 "2022-04-14T01:06:30Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\ **Post date:** [April 14, 2022, 1:06am UTC](https://onehack.st/t/melody-a-transparent-internet-sensor-built-for-threat-intelligence/218789/1 "2022-04-14T01:06:30Z")
![image](https://onehack.st/uploads/default/original/3X/0/d/0d50ab0c5429249c0654db5d6349b197ecbe43ac.jpeg) Monitor the Internet’s background noise [![Go Report Card](https://camo.githubusercontent.com/d10f3a076fece577e2037049723751e5ea10064d8be89ff6e95504f3e8c86757/68747470733a2f2f676f7265706f7274636172642e636f6d2f62616467652f6769746875622e636f6d2f626f6e6a6f75726d616c776172652f6d656c6f6479)](https://goreportcard.com/badge/github.com/bonjourmalware/melody) [![Coverage Status](https://camo.githubusercontent.com/db9d4f211ed3891a8d8b0d779f0d5ef44c898c03b14172372f04dc143fe28046/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f626f6e6a6f75726d616c776172652f6d656c6f64792f62616467652e737667)](https://coveralls.io/github/bonjourmalware/melody) [![Docker build status](https://camo.githubusercontent.com/cce59594f8fecef0f47d9f4c9a333c7bf465e9fcb64804a44716bc8004d4647b/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f636c6f75642f6275696c642f626f6e6a6f75726d616c776172652f6d656c6f6479)](https://hub.docker.com/r/bonjourmalware/melody/builds) [![Docker image size](https://camo.githubusercontent.com/ae121152b3857362b94d44317202c29ae5075786e3397d0e2ce0135b8b1b4936/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f696d6167652d73697a652f626f6e6a6f75726d616c776172652f6d656c6f64793f736f72743d64617465)](https://hub.docker.com/r/bonjourmalware/melody/builds) [![Latest release](https://camo.githubusercontent.com/9e444e12ba73f443abc4233c7197be164c404346590cf24809a7ad0c41710d27/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f626f6e6a6f75726d616c776172652f6d656c6f64792e737667)](https://github.com/bonjourmalware/melody/releases/latest) [![Documentation](https://camo.githubusercontent.com/d94174940e97e034303a0bc6a984e75f68ef27a7d159f4fa5ab275b2e7429113/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f2546302539462539332539412d446f63756d656e746174696f6e2d696e666f726d6174696f6e616c)](https://bonjourmalware.github.io/melody/) [![Installation](https://camo.githubusercontent.com/60f7871ffd6d9a682c3d44511930c1c77fe0a5e20b30fee409df3b1a6a501922/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f2546302539462539332539412d496e7374616c6c6174696f6e2d696e666f726d6174696f6e616c)](https://bonjourmalware.github.io/melody/installation) [![Quickstart](https://camo.githubusercontent.com/5801a186426bf05cc921a95512dfbbdd5d758540212e78dbdbfe68d0dcd475dd/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f2546302539462539332539412d517569636b73746172742d696e666f726d6174696f6e616c)](https://bonjourmalware.github.io/melody/quickstart) [![Go Report Card](https://camo.githubusercontent.com/fd551ba4b042d89480347a0e74e31af63b356b2cac1116c7b80038f41b04a581/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d677265656e2e737667)](https://opensource.org/licenses/MIT) Melody is a transparent internet sensor built for threat intelligence and supported by a detection rule framework which allows you to tag packets of interest for further analysis and threat monitoring. # Table of Contents - [Melody](https://github.com/bonjourmalware/melody#melody) - [Table of contents](https://github.com/bonjourmalware/melody#table-of-contents) - [Features](https://github.com/bonjourmalware/melody#features) - [Wishlist](https://github.com/bonjourmalware/melody#wishlist) - [Use cases](https://github.com/bonjourmalware/melody#use-cases) - [Internet facing sensor](https://github.com/bonjourmalware/melody#internet-facing-sensor) - [Stream analysis](https://github.com/bonjourmalware/melody#stream-analysis) - [Preview](https://github.com/bonjourmalware/melody#preview) - [Quickstart](https://github.com/bonjourmalware/melody#quickstart) - [TL;DR](https://github.com/bonjourmalware/melody#tldr) - [Release](https://github.com/bonjourmalware/melody#release) - [From source](https://github.com/bonjourmalware/melody#from-source) - [Docker](https://github.com/bonjourmalware/melody#docker) - [Rules](https://github.com/bonjourmalware/melody#rules) - [Rule example](https://github.com/bonjourmalware/melody#rule-example) - [Logs](https://github.com/bonjourmalware/melody#logs) # Features Here are some key features of Melody : - Transparent capture - Write detection rules and tag specific packets to analyze them at scale - Mock vulnerable websites using the builtin HTTP/S server - Supports the main internet protocols over IPv4 and IPv6 - Handles log rotation for you : Melody is designed to run forever on the smallest VPS - Minimal configuration required - Standalone mode : configure Melody using only the CLI - Easily scalable : - Statically compiled binary - Up-to-date Docker image # Wishlist Since I have to focus on other projects right now, I can’t put much time in Melody’s development. There is a lot of rom for improvement though, so here are some features that I’d like to implement someday : - ~~Dedicated helper program to create, test and manage rules~~ → Check Meloctl in `cmd/meloctl` - Centralized rules management - Per port mock application # Use cases ## Internet facing sensor - Extract trends and patterns from Internet’s noise - Index malicious activity, exploitation attempts and targeted scanners - Monitor emerging threats exploitation - Keep an eye on specific threats ## Stream analysis - Build a background noise profile to make targeted attacks stand out - Replay captures to tag malicious packets in a suspicious stream # Preview [![](https://raw.githubusercontent.com/bonjourmalware/melody/master/readme/melody_demo.gif)](https://raw.githubusercontent.com/bonjourmalware/melody/master/readme/melody_demo.gif) [![](https://raw.githubusercontent.com/bonjourmalware/melody/master/readme/melody_demo_dash.png)](https://raw.githubusercontent.com/bonjourmalware/melody/master/readme/melody_demo_dash.png) # Quickstart [Quickstart details.](https://bonjourmalware.github.io/melody/installation) ## TL;DR ### Release Get the latest release at `https://github.com/bonjourmalware/melody/releases` . ```auto make install # Set default outfacing interface make cap # Set network capabilities to start Melody without elevated privileges make certs # Make self signed certs for the HTTPS fileserver make enable_all_rules # Enable the default rules make service # Create a systemd service to restart the program automatically and launch it at startup sudo systemctl stop melody # Stop the service while we're configuring it ``` Update the `filter.bpf` file to filter out unwanted packets. ```auto sudo systemctl start melody # Start Melody sudo systemctl status melody # Check that Melody is running ``` The logs should start to pile up in `/opt/melody/logs/melody.ndjson`. `tail -f /opt/melody/logs/melody.ndjson # | jq` ### From source ```auto git clone https://github.com/bonjourmalware/melody /opt/melody cd /opt/melody make build ``` Then continue with the steps from the [release](https://github.com/bonjourmalware/melody#release) TL;DR. ### Docker ```auto make certs # Make self signed certs for the HTTPS fileserver make enable_all_rules # Enable the default rules mkdir -p /opt/melody/logs cd /opt/melody/ docker pull bonjourmalware/melody:latest MELODY_CLI="" # Put your CLI options here. Example : export MELODY_CLI="-s -i 'lo' -F 'dst port 5555' -o 'server.http.port: 5555'" docker run \ --net=host \ -e "MELODY_CLI=$MELODY_CLI" \ --mount type=bind,source="$(pwd)/filter.bpf",target=/app/filter.bpf,readonly \ --mount type=bind,source="$(pwd)/config.yml",target=/app/config.yml,readonly \ --mount type=bind,source="$(pwd)/var",target=/app/var,readonly \ --mount type=bind,source="$(pwd)/rules",target=/app/rules,readonly \ --mount type=bind,source="$(pwd)/logs",target=/app/logs/ \ bonjourmalware/melody ``` The logs should start to pile up in `/opt/melody/logs/melody.ndjson`. # Rules [Rule syntax details.](https://bonjourmalware.github.io/melody/installation) ## Example ```auto CVE-2020-14882 Oracle Weblogic Server RCE: layer: http meta: id: 3e1d86d8-fba6-4e15-8c74-941c3375fd3e version: 1.0 author: BonjourMalware status: stable created: 2020/11/07 modified: 2020/20/07 description: "Checking or trying to exploit CVE-2020-14882" references: - "https://nvd.nist.gov/vuln/detail/CVE-2020-14882" match: http.uri: startswith|any|nocase: - "/console/css/" - "/console/images" contains|any|nocase: - "console.portal" - "consolejndi.portal?test_handle=" tags: cve: "cve-2020-14882" vendor: "oracle" product: "weblogic" impact: "rce" ``` # Logs [Logs content details.](https://bonjourmalware.github.io/melody/layers) ## Example Netcat TCP packet over IPv4 : ```auto { "tcp": { "window": 512, "seq": 1906765553, "ack": 2514263732, "data_offset": 8, "flags": "PA", "urgent": 0, "payload": { "content": "I made a discovery today. I found a computer.\n", "base64": "SSBtYWRlIGEgZGlzY292ZXJ5IHRvZGF5LiAgSSBmb3VuZCBhIGNvbXB1dGVyLgo=", "truncated": false } }, "ip": { "version": 4, "ihl": 5, "tos": 0, "length": 99, "id": 39114, "fragbits": "DF", "frag_offset": 0, "ttl": 64, "protocol": 6 }, "timestamp": "2020-11-16T15:50:01.277828+01:00", "session": "bup9368o4skolf20rt8g", "type": "tcp", "src_ip": "127.0.0.1", "dst_port": 1234, "matches": {}, "inline_matches": [], "embedded": {} } ``` ## GitHub: > **[GitHub - ma111e/melody: Melody is a transparent internet sensor built for...](https://github.com/ma111e/melody)** > > Melody is a transparent internet sensor built for threat intelligence. Supports custom tagging rules and vulnerable application simulation.