Open software—
Material reviewed: Repository documentationhoneyTLS is a bash script that sets up Bro (Zeek) together with a JA3 script for Bro and Nginx, used as a simple honeypot to capture JA3 hashes (SSL/TLS client fingerprints). It also documents an alternative one-liner for skimming JA3 fingerprints directly off the wire.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot for attacks against TCP and UDP services; documents template-based emulation, mirror mode, and proxy mode.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingOpen framework for building and operating honeypot sensors.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction Python honeypot that mimics network services and ports and logs access attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSSH intermediary designed for use with a high-interaction honeypot: it sits between the attacker and the honeypot and creates two SSH connections. It is not described as a standalone honeypot.
Network
Open software—
Material reviewed: Repository documentationPython 2.x Telnet honeypot that emulates the service in a chroot environment. The documentation describes options for credentials, a fake hostname, and command logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot with multiple virtual hosts, sandboxed filesystems, and commands that simulate interactions between hosts.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationhttpbl is a Python client package for the Project Honeypot Http:BL API, allowing queries of threat scores and visitor types for IP addresses.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot documented to log brute-force attacks and shell sessions, with a fake filesystem.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationAn instant messenger honeypot; the documentation only describes it as 'Instant messenger honeypot', without detailing protocols or detection mechanisms.
ApplicationNetworkHoneypot
Open software—
Material reviewed: Repository documentationSimple honeypot for the Intel AMT port, inspired by a SANS ISC advisory about the risk of exposed AMT. It is intended to run alongside packet capture to log activity on the relevant ports.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationScripts to install a server and multiple honeypots, process their logs, and display information about attack attempts. The documentation lists SSH, web, and industrial-system honeypots.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA Python tool that simulates an IoT device (router) to log attacker IP addresses and activity into a logfile and MySQL database, using cloned web pages as a decoy front end.
IoTNetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA Python-based honeypot designed to emulate the Mirai malware, with separate listener and C2 components, aimed at scalable and easy setup.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneypot software that simulates embedded-device services and vulnerabilities to record requests, origins, and, where supported, payloads; includes Telnet, HTTP, and HTTPS servers.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationkippo-extra is a set of additional fake commands (gcc, iptables, netstat, etc.) for the Kippo SSH honeypot, intended to make attacker sessions more realistic.
NetworkEndpointHoneypotDecoy
Open software—
Material reviewed: Repository documentationKippo-Graph is a PHP tool that visualizes statistics and charts from data collected by the Kippo SSH honeypot, including attack geolocation, but is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationKippo-Malware is a Python script that downloads malicious files stored as URLs in the Kippo SSH honeypot's database, with support for HTTP proxies and custom User-Agent values; it is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationA Mojolicious and DBIx::Class web application that displays statistics about the Kippo (kippo) SSH honeypot. It is not itself a honeypot.
Network
Open software—
Material reviewed: Repository documentationA medium-interaction SSH honeypot documented to log brute-force attacks and shell interactions; it includes a fake filesystem and replayable session logs.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot that simulates users and a shell to observe attacker commands; it documents downloading requested files to a separate directory for analysis.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA low-interaction honeypot that spoofs service banners across thousands of ports using the nmap-service-probes file format, with support for TCP and UDP protocols, including SSL-wrapped ones.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationMailoney is a low-interaction SMTP honeypot that simulates a vulnerable mail server, capturing authentication attempts and logging sessions to an optional database.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDeployment script that runs Docker images of the Dionaea and Kippo honeypots; the script facilitates their setup but is not itself a honeypot.
Network