feat: deceptive tripwire responses + canary credentials (#12) - #26
Merged
Conversation
A tripwire can now deceive a scanner instead of just denying it — something only possible because PHP owns the whole HTTP response (node middleware can't). - WebDecoy_Decoy_Response: per-site canary credentials derived from a stored secret (deterministic, recomputable, never colliding with real values). Response modes for a tripwire hit: block (403, default), notfound (404), decoy (200 with believable fake .env / wp-config / SQL dump / phpinfo content embedding canaries), tarpit (bounded slow-drip, <=10s). - Safety: decoy content is template-only and NEVER reads a real config value; a path with no template fails closed to 403. - Deception-first: decoy/notfound/tarpit modes do NOT locally block the IP, so the scanner keeps digging decoys — each hit another reported violation — while edge enforcement still fires via the reported clearance token. - Canary-use detection: a login attempt with a canary credential (which could only have come from a served decoy) is logged CRITICAL and blocked, via a priority-5 authenticate filter. - New Tripwires-tab 'Response' selector; served canaries recorded in the detections audit trail. Verified canary determinism, is_canary_credential, all four decoy templates embed canaries, fail-closed on unknown paths, and block-mode fallthrough. Closes #12. Part of #16. Co-authored-by: Claude <noreply@anthropic.com>
15 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first beyond-parity feature — deception that
@webdecoy/nodestructurally can't do, because the WordPress plugin owns the entire HTTP response. A tripwire hit can now deceive a scanner instead of just denying it.Response modes (per the new Tripwires → Response setting)
.env,wp-config.php.bak, SQL dump, orphpinfo, each embedding unique per-site canary credentials.Canary credentials — the payoff
Canaries are derived from a per-site secret: deterministic, recomputable, and guaranteed never to collide with a real value. When a decoy is served they're recorded in the detections audit trail. Then, because they're recomputable, a later login attempt using a canary credential — something that could only have come from a decoy we served — is caught by a priority-5
authenticatefilter, logged as a critical exfiltration detection, and blocked. That turns a scanner slurping a fake.envinto attributable evidence the moment they try to use it.Safety rails
wd_clearancetoken.Tests
Verified canary determinism,
is_canary_credential(true for its own canaries, false for real-looking/empty values), that all four decoy templates embed canaries, fail-closed on unknown paths, and block-mode fallthrough (20 checks). SDK suite still green.Closes #12. Part of #16.