#!/usr/bin/env bash
# =============================================================================
#  lab6-beacon_v18.sh
#  Lab 6 — Emerging Threats Investigation
#  Runs on: UB2604 (192.168.1.10 / .15)   |   Run as: standard user
# =============================================================================
#  PURPOSE
#    Emulates a command-and-control (C2) BEACON: a periodic HTTP callback with
#    a distinctive URI and User-Agent, at a FIXED interval. The defining
#    signature of a beacon is not its content but its REGULAR TIMING.
#
#    Distinctive markers (used to write the custom signature in Part 4):
#      URI         : /beacon
#      User-Agent  : Lab6Beacon/1.0
#      Interval    : 30 seconds, 6 callbacks
#
#  SAFE BY DESIGN
#    Harmless periodic HTTP GET to a benign test endpoint. No malicious code.
#    Run in an isolated lab VM only.
#
#  BEFORE YOU RUN
#    1. Run Invoke-Lab6Attacker_v18.ps1 on WIN11 first (recon + HTTP + DNS stages).
#    2. Make this script executable:  chmod +x lab6-beacon_v18.sh
#    3. Let it run for at least 5 intervals so the timing pattern is visible.
#
#  INVESTIGATE
#    The beacon may fire NO dedicated ET Open alert — hunt it by TIMING:
#      sudo tail -n 1000 /var/log/suricata/eve.json \
#        | jq -r 'select(.event_type=="http") | "\(.timestamp) \(.dest_ip) \(.http.hostname)"' \
#        | sort
#    Look for requests at a near-constant ~30s interval to the same host.
# =============================================================================

TARGET="http://testmyids.com/beacon"
UA="Lab6Beacon/1.0"
INTERVAL=30
COUNT=6

echo "[*] Beacon starting: $(date -Is) -- $COUNT callbacks every ${INTERVAL}s"
for i in $(seq 1 "$COUNT"); do
    curl -s -A "$UA" "$TARGET" -o /dev/null
    echo "[*] beacon $i/$COUNT sent: $(date -Is)"
    sleep "$INTERVAL"
done
echo "[*] Beacon complete."