Open software2015
Material reviewed: Repository metadataRepository about Elasticsearch simulation; documentation and maintenance require further review.
NetworkHoneypot
Open software2015
Material reviewed: Repository metadataRepository about capture of USB-propagated malware; documentation and maintenance require further review.
EndpointHoneypot
Open software2015
Material reviewed: Repository metadataRepository about NoSQL-service simulation; documentation and maintenance require further review.
NetworkHoneypot
Open software2015
Material reviewed: Repository metadataRepository about SNARE web-event analysis; documentation and maintenance require further review.
ApplicationHoneypot
Open software2014
Material reviewed: Repository metadataRepository about observation of Elasticsearch attacks; documentation and maintenance require further review.
NetworkHoneypot
Open software2014
Material reviewed: Repository metadataRepository about decoy NTP service; documentation and maintenance require further review.
NetworkHoneypot
Open software2014
Material reviewed: Repository metadataRepository about Node.js application simulation; documentation and maintenance require further review.
ApplicationHoneypot
Open software2013
Material reviewed: Repository metadataRepository about industrial-system simulation; documentation and maintenance require further review.
OT/ICSHoneypot
Open software2013
Material reviewed: Repository metadataRepository about SSH simulation in Go; documentation and maintenance require further review.
NetworkHoneypot
Open software2012
Material reviewed: Repository metadataRepository about decoy MySQL service; documentation and maintenance require further review.
NetworkHoneypot
Open software2012
Material reviewed: Repository metadataRepository about phpMyAdmin simulation; documentation and maintenance require further review.
ApplicationHoneypot
Open software2011
Material reviewed: Repository metadataRepository about decoy Django admin login; documentation and maintenance require further review.
ApplicationHoneypot
Open software—
Material reviewed: Repository metadataCritical readingLow-interaction honeypot simulating the Android Debug Bridge service.
IoTHoneypot
Open software—
Material reviewed: Repository documentationDocumented honeypot for CVE-2017-5689: a web server listens on TCP port 16922 and imitates the Intel AMT management service. If exploited, it serves the attacker content obtained from an HP machine.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationAmun is a Python-based low-interaction honeypot, described as the first of its kind, following Nepenthes' concepts while extending emulation. Per its documentation, it logs exploitation attempts, malware downloads, and unknown shellcode across separate log files.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA user-friendly, CISO-friendly configuration, management and acquisition tool for honeyd that provides a usable interface for configuring, deploying honeypots and receiving their logs from a central server.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDescribed as a low-interaction honeypot; the source does not specify its environment or features.
Honeypot
Open software—
Material reviewed: Repository documentationArgos is an advertised honeypot using dynamic taint analysis to detect and analyze control flow attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationTool combining a honeypot on commonly attacked ports with monitoring and alerts; according to the documentation, it blacklists IPs that connect to those ports.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationWeb honeypot that responds to HEAD and GET requests with an HTTP Basic challenge and logs received credentials; it accepts no username or password.
ApplicationIdentityHoneypot
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationA tool that parses logs from multiple honeypots (Kippo/Cowrie SSH, phpMyAdmin, Wordpot, Redispot, VncLowPot, Pghoney) to extract malicious IPs, URLs, and file hashes and publish them as pulses in AlienVault OTX.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA high-interaction HTTP/HTTPS honeypot that presents vulnerable web applications to observe attacker access. The documentation says it sends logs to BigQuery and saves packet captures.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationOpen-source tool that scans systems to detect misconfigurations or fingerprints revealing honeypots, helping researchers make them harder to detect.
NetworkHoneypot