KFSensor includes a number of example scripts that implement simple services. These can be configured to run as external console applications using the Edit External Console App dialog box.
The scripts are located in the directory:
C:\Program Files\KeyFocus\KFSensor\files\scripts
Your own scripts can be located in any directory on the local hard drive.
The example scripts are written in PERL. In order to use these scripts you will need to install a copy of PERL.
The descriptions below contains the field values that need to be entered into the Edit External Console App dialog box.
This basic script emulates the Microsoft Quote of the day service. It chooses one of 11 quotes at random and sends the text to the visitor.
Note: It is important to include the quotes in the Argument field as PERL does not like a space in a path name.
| Field | Value |
| Name | Ex Quote |
| Default port | 17 |
| Application ID | Quote of the day |
| Application Path | C:\Perl\bin\perl.exe |
| Arguments | "C:\Program Files\KeyFocus\KFSensor\files\scripts\kfquoteoftheday.pl" |
| Working directory | C:\Program Files\KeyFocus\KFSensor\files |
| Exit code |
This script implements the echo service, which simple reads data from the socket and writes the same data back to the socket.
Note: This script will continue running until either the visitor closes the connection or KFSensor times out the connection.
| Field | Value |
| Name | Ex Echo |
| Default port | 7 |
| Application ID | Echo |
| Application Path | C:\Perl\bin\perl.exe |
| Arguments | "C:\Program Files\KeyFocus\KFSensor\files\scripts\kfecho.pl" |
| Working directory | C:\Program Files\KeyFocus\KFSensor\files |
| Exit code |
This script is useful for debugging purposes only. It sends its command line arguments and environment variables to the visitor.
Note: The $ arguments will be substituted with their parameter values.
| Field | Value |
| Name | Ex Test Script |
| Default port | 3000 |
| Log Response Size | 10240 |
| Application ID | TestScript |
| Application Path | C:\Perl\bin\perl.exe |
| Arguments | "C:\Program Files\KeyFocus\KFSensor\files\scripts\kftest.pl" $ipdst $dport $ipsrc $sport $appid $proto $domain test |
| Working directory | C:\Program Files\KeyFocus\KFSensor\files |
| Exit code |
There are a number of scripts that emulate services that have been released as open source on the Internet.
Many of these have been written for the Honeyd system. Most of these scripts are compatible with KFSensor.
This example configuration is for a Unix shell script that emulates a POP3 server.
In order to run a shell script you will need to install CygWin, http://www.cygwin.com.
| Field | Value |
| Name | Ex POP3 |
| Default port | 110 |
| Log style | Mixed |
| Application ID | POP3 |
| Application Path | C:\cygwin\bin\bash.exe |
| Arguments | --login -c /home/scripts/pop3.sh $ipsvc $ipdst $sport $dport |
| Working directory | |
| Exit code |