Open software—
Material reviewed: Repository documentationA user-friendly, CISO-friendly configuration, management and acquisition tool for honeyd that provides a usable interface for configuring, deploying honeypots and receiving their logs from a central server.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDescribed as a low-interaction honeypot; the source does not specify its environment or features.
Honeypot
Open software—
Material reviewed: Repository documentationArgos is an advertised honeypot using dynamic taint analysis to detect and analyze control flow attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationTool combining a honeypot on commonly attacked ports with monitoring and alerts; according to the documentation, it blacklists IPs that connect to those ports.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationWeb honeypot that responds to HEAD and GET requests with an HTTP Basic challenge and logs received credentials; it accepts no username or password.
ApplicationIdentityHoneypot
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationAnsible deployment repository for Bifrozt. Its deception link is its reference to installation documentation and honeypot risks; the README does not say this repository is itself a honeypot.
Open software—
Material reviewed: Repository documentationA tool that parses logs from multiple honeypots (Kippo/Cowrie SSH, phpMyAdmin, Wordpot, Redispot, VncLowPot, Pghoney) to extract malicious IPs, URLs, and file hashes and publish them as pulses in AlienVault OTX.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA high-interaction HTTP/HTTPS honeypot that presents vulnerable web applications to observe attacker access. The documentation says it sends logs to BigQuery and saves packet captures.
ApplicationHoneypot
Open software—
Material reviewed: Repository metadataCritical readingOpen project for creating decoy tokens that alert when someone uses them.
IdentityCloudHoneytoken
Open software—
Material reviewed: Repository documentationOpen-source tool that scans systems to detect misconfigurations or fingerprints revealing honeypots, helping researchers make them harder to detect.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingSSH and Telnet honeypot that records login attempts and attacker sessions.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationAn academic project that deploys a honeypot alongside an Elastic stack (Elasticsearch/Kibana) and ElastAlert, including a custom 'MITREAttack' alert that writes information according to the MITRE ATT&CK matrix for detecting and classifying attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationTool that parses Cowrie honeypot logs into a Neo4j database; it supports analysis infrastructure rather than being presented as a honeypot.
Open software—
Material reviewed: Repository documentationDistributed low-interaction honeypot whose agents simulate services with protocol handlers and whose master receives attack information.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingHoneypot project for observing attacks against network services.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA low-interaction honeypot, successor to nepenthes, offering emulated network services such as SMB, HTTP, FTP, TFTP, and MSSQL via embedded Python and libemu, aiming to capture copies of malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea is a low-interaction honeypot, successor to nepenthes, designed to trap malware exploiting vulnerabilities in network services offered to a network, with the goal of obtaining a copy of the malware.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDionaea-Vagrant is a set of scripts and a Vagrantfile that automate deployment of a virtual machine running the Dionaea malware honeypot on Ubuntu 12.04, installing dependencies and running it as a daemon alongside p0f.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationWeb front end for the Dionaea low-interaction honeypot, with connection filters and attack graphs. It is honeypot-adjacent visualization infrastructure, not itself a honeypot.
Network
Open software—
Material reviewed: Public pageA Django application for browsing the Kippo SSH honeypot’s MySQL data in the admin panel; it is not described as a honeypot itself.
Network
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot packaged in a Docker container that listens on port 2222, logs IP addresses, usernames, and passwords from login attempts, and then disconnects the client.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDocker files for testing software and long-term containers. Although the repository name refers to a honeynet, the text does not explain a functional deception link or describe the files as a honeypot.
Open software—
Material reviewed: Repository documentationDocumented project implementing a Docker-based high-interaction SSH honeypot, using patched bash and OpenSSH to log commands and credentials, integrated into a larger architecture of agents and attack-detection servers.
NetworkCloudHoneypot