Honeypots
Deception trap, designed to entice an attacker into attempting to compromise the information systems in an organization.
Contents
- Database Honeypots
- Web honeypots
- Service Honeypots
- Distributed Honeypots
- Anti-honeypot stuff
- ICS/SCADA honeypots
- Other/random
- Botnet C2 tools
- IPv6 attack detection tool
- System instrumentation
- Honeypot for USB-spreading malware
- Distributed sensor deployment
- Low interaction honeypot (router back door)
- Binary debugger
- Passive network audit framework parser
- VM monitoring and tools
- Client
- Malware collector
- Data Collection
Related Lists
Honeypots
Database Honeypots
Web honeypots
Cloud active defense lets you deploy decoys right into your cloud applications, putting adversaries into a dilemma: to hack or not to hack?
Honeypot that tries to crash the bots and clients that visit it's location.
Simple spam prevention package for Laravel applications.
Distributed web application honeypot to interact with large scale exploitation attempts.
Struts Apache 2 based honeypot as well as a detection module for Apache 2 servers.
Designed to create deceptive webpages to deceive and redirect attackers away from real websites.
Fake Django admin login screen to notify admins of attempted unauthorized access.
Modpot is a modular web application honeypot framework and management application written in Golang and making use of gin framework.
Honeypot that mimics Tomcat manager endpoints. Logs requests and saves attacker's WAR file for later study.
WordPress login honeypot for collection and analysis of failed login attempts.
Service Honeypots
Low interaction honeypot that simulates an Android device running Android Debug Bridge (ADB) server process.
NTP, DNS, SSDP, Chargen and generic UDP-based amplification DDoS honeypot.
Simple Docker Honeypot server emulating small snippets of the Docker HTTP API.
The first A.I based open source honeypot. supports POP3 and SMTP protocols and generates content using A.I based on user description.
Plugin repository for Honeycomb, the honeypot framework by Cymmetria.
25 different honeypots in a single pypi package! (dns, ftp, httpproxy, http, https, imap, mysql, pop3, postgres, redis, smb, smtp, socks5, ssh, telnet, vnc, mssql, elastic, ldap, ntp, memcache, snmp, oracle, sip and irc).
Advanced Honeypot framework written in Go that can be connected with other honeypot software.
Low interaction honeypot to detect CVE-2018-2636 in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (MICROS).
RDP man-in-the-middle and library for Python 3 with the ability to watch connections live or after the fact.
High interaction SMB service honeypot capable of capturing wannacry-like Malware.
Modural and easy to install Python Honeypot, with comprehensive alerting
Honeypot that runs each connection with the service within a separate LXC container.
Distributed Honeypots
Anti-honeypot stuff
ICS/SCADA honeypots
Other/random
Let's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise.
Redirects traffic for unused IPs to a honeypot, built on POX.
Modular and decentralised honeypot daemon that runs several canary versions of services that alerts when a service is (ab)used.
Botnet C2 tools
IPv6 attack detection tool
System instrumentation
Honeypot for USB-spreading malware
Distributed sensor deployment
Low interaction honeypot (router back door)
Binary debugger
Passive network audit framework parser
VM monitoring and tools
Malware collector
Server
Reverse engineering, Malware and goodware analysis of Android applications and more.
Powerful GUI tool for analysts to analyze the Android applications.
Open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
Low interaction Python honeypot designed to mimic services or ports that might get targeted by attackers.
Semi-Intelligent HoneyPot Network - HoneyNet Intelligent Virtual Environment.
Low-interaction honeypot and network security tool written to catch attacks against TCP and UDP services.
Data Collection / Data Sharing
Honeypot deployment
Client
Highly-scalable system integrating multiple client honeypots to detect malicious websites.
Honeypot
PDF document inspector
SSH Honeypots
Tiny interaction SSH honeypot engineered in Python to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.
Low interaction SSH honeypot written in Python and based on Kojoney by Jose Antonio Coret.
Python based command line tool to analyze cowrie logs over time.
Mock an SSH server and define all commands it supports (Python, Twisted).
Modified version of the OpenSSH deamon that forwards commands to Cowrie where all commands are interpreted and returned.
Spamtrap
Server (Bluetooth)
Dockerized Low Interaction packaging
IOT Honeypot
Honeytokens
Self-hostable honeytoken generator and reporting dashboard; demo version available at CanaryTokens.org.
Simple tool designed to enhance the effectiveness of your traps by spreading breadcrumbs and honeytokens across your production servers and workstations to lure the attacker toward your honeypots.
Honeyd Tools
Network and Artifact Analysis
Data Tools
Front Ends
Visualization
Network recon framework, published by @cea-sec & @ANSSI-FR. Build your own, self-hosted and fully-controlled alternatives to Criminalip / Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, collect and analyse network intelligence from your sensors, and much more!