Bash History Enterprise
This breadcrumb injects a command containing your Trapster's address and fake credentials into the user's ~/.bash_history file. The command is placed randomly within existing history so it looks natural.
Attackers who filter history for strings like passwords, IPs, or ssh commands will find it and attempt to connect.
Generate from any compatible service row (SSH, FTP, HTTP, HTTPS, SMB, MySQL, PostgreSQL, MSSQL, Telnet, Rsync).
Installation
Download the generated script (e.g. script.sh), then run it with a leading space to prevent the execution itself from being recorded in history:
chmod +x script.sh
./script.shLeading space matters
The leading space before each command tells Bash not to record that command in history (when HISTCONTROL=ignorespace is set, which is the default on most distributions). This ensures the breadcrumb appears genuine; only the injected entry will show up.
The script modifies ~/.bash_history directly, inserting the fake command at a random position.
