Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot documented to log brute-force attacks and shell sessions, with a fake filesystem.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA Python tool that simulates an IoT device (router) to log attacker IP addresses and activity into a logfile and MySQL database, using cloned web pages as a decoy front end.
IoTNetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationkippo-extra is a set of additional fake commands (gcc, iptables, netstat, etc.) for the Kippo SSH honeypot, intended to make attacker sessions more realistic.
NetworkEndpointHoneypotDecoy
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot that simulates users and a shell to observe attacker commands; it documents downloading requested files to a separate directory for analysis.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA low-interaction honeypot that spoofs service banners across thousands of ports using the nmap-service-probes file format, with support for TCP and UDP protocols, including SSL-wrapped ones.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationAn experimental and incomplete alpha-stage program that tracks decoy ('honey pot') files with names, extensions, and paths likely to be encrypted by ransomware, killing processes that lock them when opened.
EndpointDecoy
Open software—
Material reviewed: Repository documentationA historical Linux honeypot that listens on unused ports via xinetd and netfilter/REDIRECT, providing phony responses to attacker commands to consume their resources and complement IDS systems like Snort.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationHoneypot that emulates a default Belkin N300 wireless router administration interface to observe traffic directed at home routers.
NetworkIoTHoneypotDecoy
Open software—
Material reviewed: Repository documentationAn internal web honeypot built with Django and Docker, designed to capture APT activity and insider intrusions using a decoy login interface.
ApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationTools for cloning webpages, particularly login pages, and serving them as decoys. The documentation says the server reports requests to a syslog server.
ApplicationDecoy