feat(security): deploy OpenCanary honeypot on VLAN 50 with Gotify and Discord alerting

scripts/find_nabu_casa.py

@@ -0,0 +1,26 @@
+import paramiko
+import sys
+
+sys.stdout.reconfigure(encoding='utf-8')
+key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'
+
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
+
+stdin, stdout, stderr = c.exec_command("grep -rn 'nabu.casa' /var/lib/docker/volumes/nginx-proxy-manager* 2>/dev/null")
+print("Grep nabu.casa in NPM data:\n", stdout.read().decode())
+
+py_query = """
+import sqlite3
+conn = sqlite3.connect('/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite')
+cur = conn.cursor()
+cur.execute('SELECT * FROM redirection_host')
+print('Redirection hosts:', cur.fetchall())
+conn.close()
+"""
+stdin, stdout, stderr = c.exec_command(f'python3 -c "{py_query}"')
+print("SQLite redirection hosts:\n", stdout.read().decode())
+
+c.close()
+