neilphan98/hearth-attacker repository overview

⁠HEARTH Attacker-IDS Host

Attacker / IDS host: tcpdump, tshark, nmap, scapy, hping3 on the zone.

Real-device analogue: A pentest workstation or an inline sensor (a Kali-class box).

Protocol / ports: All (raw capture + active scanning on the attached zone).

⁠What it does / how it works

A toolbox tenant. On a hub it sees all zone traffic (IDS vantage); as an active host it can scan and inject. Backs both the internet-side and pentest-side attacker roles.

⁠Functions

• Packet capture (tcpdump/tshark)
• Discovery/scan (nmap)
• Crafting/flooding (scapy, hping3)

⁠How to use

Console in and run tcpdump -i eth0 -n, nmap -sn 192.168.6.0/24, or your own scapy. Wire to an Ethernet HUB to passively see everything on the segment.

⁠Use in GNS3

• Import the matching .gns3a (File > Import appliance), or docker pull neilphan98/hearth-attacker:1.1.
• Drag onto your topology, wire to a switch/hub, start. Console: telnet.
• Adapters: 1. Category: guest.

IPv4 device: leave MQQ1_IP empty to auto-assign a unique IP (zero-config), or set a fixed address. Zone via HEARTH_OCTET (5 corp / 6 ot / 8 security).

⁠Default environment (per node)

MQQ1_IP=192.168.6.66
MQQ1_PREFIX=24
MQQ1_GW=192.168.6.1
MQQ1_IP6=fd11:1111:1111:6::42
MQQ1_IP6_PREFIX=64
MQQ1_GW6=fd11:1111:1111:6::1

Current release: 1.1 (docker pull neilphan98/hearth-attacker:1.1)

Part of the HEARTH Tower commercial-building IoT/OT security testbed. Image tags are immutable per release (1.0, 1.1, ...), so updating the device list never changes nodes you already placed. See the HEARTH bundle for all devices + guides.