#!/usr/bin/env bash
# =============================================================================
#  Lab_06_Generate_Beacon_Traffic_v20.sh
#  Lab 6 - Emerging Threats Investigation
#  © 2026 Jim Furstenberg - Ph.D., P.I. · Kalos Cybersecurity LLC · v20
#  Runs on: UB2604 (ens160: 192.168.1.10; ens192: no IP) | Run as: standard user
# =============================================================================
#  PURPOSE
#    Emulates a command-and-control (C2) BEACON: a periodic HTTP callback with
#    a distinctive URI and User-Agent, at a FIXED interval. The defining
#    signature of a beacon is not its content but its REGULAR TIMING.
#
#    Distinctive markers (used to write the custom signature in Part 4):
#      URI         : /beacon
#      User-Agent  : Lab6Beacon/1.0
#      Interval    : 30 seconds, 6 callbacks
#
#  SAFE BY DESIGN
#    Harmless periodic HTTP GET to a benign test endpoint. No malicious code.
#    Run in an isolated lab VM only.
#
#  BEFORE YOU RUN
#    1. Run Lab_06_Generate_Attack_Telemetry_v20.ps1 on WIN11 first.
#    2. Make this script executable: chmod +x Lab_06_Generate_Beacon_Traffic_v20.sh
#    3. Let it run for at least 5 intervals so the timing pattern is visible.
#
#  INVESTIGATE
#    The beacon may fire NO dedicated ET Open alert - hunt it by TIMING:
#      sudo tail -n 1000 /var/log/suricata/eve.json \
#        | jq -r 'select(.event_type=="http") | "\(.timestamp) \(.dest_ip) \(.http.hostname)"' \
#        | sort
#    Look for requests at a near-constant ~30s interval to the same host.
# =============================================================================

TARGET="http://testmyids.com/beacon"
UA="Lab6Beacon/1.0"
INTERVAL=30
COUNT=6

command -v curl >/dev/null 2>&1 || { echo "[!] curl is required but is not installed." >&2; exit 1; }

echo "[*] Beacon starting: $(date -Is) -- $COUNT callbacks every ${INTERVAL}s"
for i in $(seq 1 "$COUNT"); do
    if curl --fail --silent --show-error --max-time 15 -A "$UA" "$TARGET" -o /dev/null; then
        echo "[*] beacon $i/$COUNT sent: $(date -Is)"
    else
        echo "[!] beacon $i/$COUNT failed: $(date -Is)" >&2
    fi
    [[ "$i" -lt "$COUNT" ]] && sleep "$INTERVAL"
done
echo "[*] Beacon complete."