GoNetSim

A programmable network simulator for malware analysis; simulate any network protocol with small, sandboxed, shareable Lua handlers.

Installation See the Repository

Supported services

DNS

DNS server supporting A/AAAA records. Can be used in combination with the HTTP & HTTPS services to simulate C2 domains.

Reference

HTTP

HTTP server with two modes: “Fake” mode returns a realistic response for any request & file extension, while “Real” mode serves static files from a specified directory.

Reference

HTTPS

HTTPS server extending the functionality of the HTTP service by adding TLS support. Possesses the same two modes of operation as the HTTP service.

Reference

Custom Listeners

Generic TCP/UDP listeners extend GoNetSim to almost any protocol. Use the built-in echo & sink handlers, or write your own in sandboxed Lua

Scripting guide

Lua Scripting

See the full Lua API specification for scripting

API Reference