Open software—
Material reviewed: Repository documentationAn academic project that deploys a honeypot alongside an Elastic stack (Elasticsearch/Kibana) and ElastAlert, including a custom 'MITREAttack' alert that writes information according to the MITRE ATT&CK matrix for detecting and classifying attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationDistributed low-interaction honeypot whose agents simulate services with protocol handlers and whose master receives attack information.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingHoneypot project for observing attacks against network services.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA low-interaction honeypot, successor to nepenthes, offering emulated network services such as SMB, HTTP, FTP, TFTP, and MSSQL via embedded Python and libemu, aiming to capture copies of malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea is a low-interaction honeypot, successor to nepenthes, designed to trap malware exploiting vulnerabilities in network services offered to a network, with the goal of obtaining a copy of the malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea-Vagrant is a set of scripts and a Vagrantfile that automate deployment of a virtual machine running the Dionaea malware honeypot on Ubuntu 12.04, installing dependencies and running it as a daemon alongside p0f.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationWeb front end for the Dionaea low-interaction honeypot, with connection filters and attack graphs. It is honeypot-adjacent visualization infrastructure, not itself a honeypot.
Network
Open software—
Material reviewed: Public pageA Django application for browsing the Kippo SSH honeypot’s MySQL data in the admin panel; it is not described as a honeypot itself.
Network
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot packaged in a Docker container that listens on port 2222, logs IP addresses, usernames, and passwords from login attempts, and then disconnects the client.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDocumented project implementing a Docker-based high-interaction SSH honeypot, using patched bash and OpenSSH to log commands and credentials, integrated into a larger architecture of agents and attack-detection servers.
NetworkCloudHoneypot
Open software—
Material reviewed: Repository documentationDocker-based honeypot documented as an SSH decoy on port 22, using containers and auditd logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSDN honeypot with an HTTP interface that simulates a failed login without connecting to a real service; the documentation suggests checking PostgreSQL records.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker container that starts a Cowrie-based SSH honeypot and enables statistics reporting to DShield.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot that listens for connections on a configurable port, can send a reply, and triggers event handlers, including an email handler.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationElasticPot is a honeypot that emulates an Elasticsearch service, compatible with DTAG's T-Pot environment and also available as a dockerized version.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationSSH tarpit that slowly sends an endless banner to tie up connecting SSH clients while the real SSH server uses another port.
NetworkAdversary engagementDecoy
Open software—
Material reviewed: Repository documentationA Splunk app that analyzes JSON logs from the Cowrie SSH honeypot to provide dashboards and metrics on attacker engagement, aiming to observe behavioral changes when honeypot configuration settings are adjusted.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationA MicroPython honeypot for the ESP8266 microcontroller that emulates a Telnet server to attract and observe attack attempts against exposed Telnet devices.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationA toolset including an Ethereum RPC node scanner and stealer, along with an RPC node honeypot described as intended to collect attacker information.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA collection of scripts to install and run DionaeaFR and to index Cowrie honeypot data into Elasticsearch, aiding visualization of data collected from Dionaea and Cowrie honeypots.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA Python honeypot that listens on all TCP and UDP ports, emulating services such as SSH, telnet, SMTP, HTTP/HTTPS, SIP (with sipvicious scan detection), and a Netis router factory backdoor, logging unrecognized traffic in hexdump-like form.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationFakeSSH is a dockerized SSH honeypot server written in Go that logs login attempts. Per its documentation, password authentication always fails, so no terminal access is granted to the attacker.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationProtocol server simulator documenting fake network services, interactions, and traffic logging, including industrial protocols.
NetworkOT/ICSDecoy
Open software—
Material reviewed: Repository documentationGo honeypot server documented to listen on configured ports and log details of received data to a database.
NetworkHoneypot