honeybadger

honeybadger

Flood forms with fake information designed for phishing sites to dilute down any legitimate submissions.

Author: Andy Dixon - www.dixon.cx

What It Does

honeybadger fetches a page, finds its forms, fills blank fields with plausible fake values, preserves hidden and pre-filled values, submits each starting form, then follows any form returned by each response. Each configured hit starts fresh form journeys from the target URL.

Supported form handling:

• GET and POST form methods.
• Relative, absolute, and empty form actions.
• input, select, and textarea fields.
• Preserved hidden fields, selected options, checked radio buttons, checked checkboxes, and pre-filled values.
• Generated names, emails, passwords, phone numbers, addresses, and fallback random text.
• Multi-page form journeys bounded by --max-pages.

Use only where you are legally permitted to send traffic.

Build

git clone git@github.com:andydixon/honeybadger.git honeybadger
cd honeybadger
go build ./...

To build release binaries locally for Linux, macOS, and Windows on Intel and ARM:

./scripts/build.sh

Artifacts are written to dist/.

Run

Via Go:

go run . -- -u http://url/to/form.htm -n 500 -d 250

With a build:

honeybadger -u http://url/to/form.htm -n 500 -d 250

Options:

  -u, --url URL          URL containing the first form
  -n, --num HITS         number of form journeys to submit (default: 1000)
  -d, --delay DELAY_MS   delay in milliseconds after each request (default: 500)
      --max-pages PAGES  maximum forms to follow per journey (default: 5)
      --timeout SECONDS  HTTP timeout per request (default: 30)

Releases

GitHub Actions publishes a release when a tag matching v* is pushed:

git tag v0.1.0
git push origin v0.1.0

The release workflow builds:

• Linux amd64 and arm64
• macOS amd64 and arm64
• Windows amd64 and arm64