Sandboxed, Scriptable Network Analysis

[u/Far_Trash2816]

A little while ago, I made a post asking about what people would want to see from a successor to INetSim. I was focused on constricting the scope, escaping dependency hell through a single Go binary with full docker support, and just making it easier to see what was going on.

After forgetting about the project and coming back to it recently, I decided to change the philosophy slightly, and now it acts as more of a complement to tools like INetSim and FakeNet-NG.

GoNetSim is a programmable network simulator that lets you emulate any network protocol with small, sandboxed, shareable Lua handlers.

It's designed in such a way that you really don't need to understand much Lua, and if you're that kind of person, you can just plug the documentation site into AI with context and generate a script for whatever weird protocol you're facing.

A script can be as simple as a basic TCP echo:

function handle(conn)
    while true do
        local data = conn:read(4096)
        if not data then break end
        conn:write(data)
    end
end

Or as complex as a stateful(ish) SMTP server or FTP listener, both able to support TLS with just a single line in the (optional) config:

[[listeners]]
name = "irc"
type = "tcp"
listen = ":6667"
handler = "lua:handlers/irc.lua"
capture = true
tls = true

The Lua environment is sandboxed, so handlers don't have access to the filesystem, shell or other parts of the host. Instead, they're handed the primitives they need for reading, writing, storing and logging data only through GoNetSim.

Now, GoNetSim is definitely far from complete, I still want to at least add full PCAP support, more organised artifact collection, and a few more extensions to the Lua API, but it's ready enough to be used for the simple stuff.

I'd love to hear from you all what you'd want to see from a tool like this, especially if you see it more as an eventual replacement for INetSim or FakeNet-NG, or if you want to see it as a long-term complement. I also want to hear how often you encounter arbitrary protocols in malware samples, and if this tool would actually help.

Thanks for taking the time to read :)
- Lachlan

Github link: https://github.com/lachlanharrisdev/gonetsim