Open software—
Material reviewed: Repository documentationA Drupal module that adds a hidden honeypot field and a time-based restriction to forms in order to detect and block automated spam submissions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationProof-of-concept observation-camera honeypot documenting a watermark, daylight intensity, and automatic refresh.
IoTHoneypot
Open software—
Material reviewed: Repository documentationNode.js honeypot that emulates the TCP-32764 router backdoor and provides logs for monitoring.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA collection of support scripts for honeypots, minimally described in its documentation.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA script for Ubuntu 12.04 that automatically installs and configures Kippo, Dionaea, and p0f as system services, changing the SSH port and turning the host into a honeypot.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationFlask site for displaying data collected by an SSH honeypot, including attempts and statistics. It is deception-adjacent visualization software, not itself described as a honeypot.
Network
Open software—
Material reviewed: Repository documentationExample of using honeypots with a Standalone model and a model with the Joomla CMS for PHP applications.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationHoneyPress is a WordPress honeypot shipped in a Docker container, documented with a Flask/Python reimplementation simulating a WordPress install, logging access via Nginx, and storing captured payloads (including IP, user-agent, and commands) in a MongoDB database.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationPrinter honeypot proof of concept.
Honeypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot with plugins that can emulate TCP or UDP services and log activity. The project states it is no longer actively developed.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA simple web application honeypot that uses SimpleHTTPServer to serve a retro-styled HTML page, intended to attract and log basic web interactions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker Compose configurations and scripts for deploying Honeysat components. The README links its submodules to a honeypot system but does not present the deployment repository itself as a honeypot.
Honeypot
Open software—
Material reviewed: Repository documentationExtensible SSH honeypot written in Go using crypto/ssh to accept connections and log failed login attempts, including usernames and passwords. It supports dropping process privileges and includes a Lua-based plugin engine to process captured information, plus a virtual filesystem to more convincingly emulate a system.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationSystem integrating multiple client honeypots and a crawler to process URLs and detect malicious websites.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot that logs username and password attempts during brute-force attacks, rejecting them with a wrong-password message. Includes statsd, a simple HTTP API for querying login attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA bash script for CentOS that combines Apache, Cloudflare, and a CMS (mainly WordPress) to detect malicious requests in server logs and temporarily block the attacker's real IP via the Cloudflare API.
ApplicationNetworkDecoy
Open software—
Material reviewed: Repository documentationHoneypot that simulates a modem or router with a RomPager web server and TR-069 support; it documents vulnerability emulation and communication logging.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationhoneyTLS is a bash script that sets up Bro (Zeek) together with a JA3 script for Bro and Nginx, used as a simple honeypot to capture JA3 hashes (SSL/TLS client fingerprints). It also documents an alternative one-liner for skimming JA3 fingerprints directly off the wire.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot for attacks against TCP and UDP services; documents template-based emulation, mirror mode, and proxy mode.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingOpen framework for building and operating honeypot sensors.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction Python honeypot that mimics network services and ports and logs access attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationSSH intermediary designed for use with a high-interaction honeypot: it sits between the attacker and the honeypot and creates two SSH connections. It is not described as a standalone honeypot.
Network
Open software—
Material reviewed: Repository documentationPython 2.x Telnet honeypot that emulates the service in a chroot environment. The documentation describes options for credentials, a fake hostname, and command logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot with multiple virtual hosts, sandboxed filesystems, and commands that simulate interactions between hosts.
NetworkHoneypotDecoy