Trap Document Seeding

"""
Trap Document Generator.
Creates documents with enticing names and embedded tracking mechanisms
that alert when opened or exfiltrated.
"""
import os
import json
from datetime import datetime, timedelta
import random

class TrapDocumentGenerator:
    def __init__(self, callback_url: str):
        self.callback_url = callback_url
        self.inventory = []

    def generate_html_document(
        self, filename: str, content: str, token_id: str
    ) -> str:
        """Generate an HTML document with an embedded tracking pixel."""
        tracking_pixel = (
            f'<img src="{self.callback_url}/t/{token_id}/pixel.gif" '
            f'width="1" height="1" style="display:none" />'
        )

        html = f"""<!DOCTYPE html>
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>{filename}</title>
<style>
  body {{ font-family: Calibri, Arial; margin: 40px;
         font-size: 11pt; color: #333; }}
  .header {{ border-bottom: 2px solid #003366;
             padding-bottom: 10px; margin-bottom: 20px; }}
  .confidential {{ color: red; font-weight: bold;
                    font-size: 14pt; }}
  table {{ border-collapse: collapse; width: 100%;
           margin: 15px 0; }}
  th, td {{ border: 1px solid #ccc; padding: 8px 12px;
            text-align: left; }}
  th {{ background: #003366; color: white; }}
</style>
</head><body>
<div class="header">
  <p class="confidential">CONFIDENTIAL - INTERNAL USE ONLY</p>
  <h1>{filename.replace('.html', '')}</h1>
  <p>Last updated: {datetime.now().strftime('%B %d, %Y')}</p>
</div>
{content}
{tracking_pixel}
</body></html>"""

        return html

    def create_password_list(self, token_id: str) -> str:
        """Create a fake password list document - irresistible to attackers."""
        passwords = [
            ("admin", "Adm1n#2026!", "Domain Admin"),
            ("sa", "SqlS4#Pr0d2026", "SQL Server SA"),
            ("svc_backup", "B4ckup_N1ghtly!", "Backup Service"),
            ("root", "R00tL1nux#26", "Linux Root (prod-web-*)"),
            ("deploy", "D3pl0y!CI_CD", "Jenkins Deploy"),
            ("firewall_admin", "Fw@dmin_P4lo!", "Palo Alto Admin"),
        ]

        rows = "".join(
            f"<tr><td>{u}</td><td>{p}</td><td>{d}</td></tr>"
            for u, p, d in passwords
        )

        content = f"""
<p>Emergency access credentials - updated quarterly.</p>
<p style="color:red">DO NOT SHARE. Store in secure location only.</p>
<table>
  <tr><th>Username</th><th>Password</th><th>System</th></tr>
  {rows}
</table>
<p><em>Next rotation: {
    (datetime.now() + timedelta(days=90)).strftime('%B %Y')
}</em></p>"""

        return self.generate_html_document(
            "IT_Emergency_Access_Credentials.html",
            content,
            token_id,
        )

    def create_network_diagram(self, token_id: str) -> str:
        """Create a fake network architecture document."""
        content = """
<h2>Production Network Architecture</h2>
<table>
  <tr><th>Segment</th><th>CIDR</th><th>Purpose</th><th>Key Hosts</th></tr>
  <tr><td>DMZ</td><td>10.1.0.0/24</td><td>Public-facing</td>
      <td>web-lb-01, web-lb-02</td></tr>
  <tr><td>Application</td><td>10.2.0.0/24</td><td>App servers</td>
      <td>app-01 through app-12</td></tr>
  <tr><td>Database</td><td>10.3.0.0/24</td><td>Data tier</td>
      <td>prod-db-01, prod-db-02 (HA pair)</td></tr>
  <tr><td>Management</td><td>10.10.0.0/24</td><td>Admin access</td>
      <td>jump-01, monitoring-01, deploy-01</td></tr>
</table>
<h3>VPN Access</h3>
<p>Corporate VPN endpoint: vpn.corp.external (GlobalProtect)</p>
<p>Admin VPN: admin-vpn.corp.external (certificate-based auth)</p>
<h3>Cloud Resources (AWS us-east-1)</h3>
<p>VPC: vpc-0a1b2c3d4e (10.100.0.0/16)</p>
<p>EKS Cluster: prod-k8s-cluster</p>"""

        return self.generate_html_document(
            "Network_Architecture_CONFIDENTIAL.html",
            content,
            token_id,
        )

    def deploy_documents(self, output_dir: str):
        """Generate and deploy all trap documents."""
        os.makedirs(output_dir, exist_ok=True)

        docs = [
            ("password_list", self.create_password_list),
            ("network_diagram", self.create_network_diagram),
        ]

        for token_name, generator in docs:
            token_id = f"doc_{token_name}_{os.urandom(4).hex()}"
            html = generator(token_id)

            # Determine filename from the HTML title
            filename = html.split("<title>")[1].split("</title>")[0]
            filepath = os.path.join(output_dir, filename)

            with open(filepath, "w") as f:
                f.write(html)

            self.inventory.append({
                "token_id": token_id,
                "filename": filename,
                "filepath": filepath,
                "created": datetime.utcnow().isoformat(),
            })
            print(f"[+] Created: {filepath}")

        # Save inventory for alert correlation
        inv_path = os.path.join(output_dir, ".token_inventory.json")
        with open(inv_path, "w") as f:
            json.dump(self.inventory, f, indent=2)

if __name__ == "__main__":
    gen = TrapDocumentGenerator(
        callback_url="https://tokens.shadow-cdf.internal"
    )
    gen.deploy_documents("/srv/shares/IT-Documentation")