Open software—
Material reviewed: Repository documentationA script for Ubuntu 12.04 that automatically installs and configures Kippo, Dionaea, and p0f as system services, changing the SSH port and turning the host into a honeypot.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationExample of using honeypots with a Standalone model and a model with the Joomla CMS for PHP applications.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationHoneyPress is a WordPress honeypot shipped in a Docker container, documented with a Flask/Python reimplementation simulating a WordPress install, logging access via Nginx, and storing captured payloads (including IP, user-agent, and commands) in a MongoDB database.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationPrinter honeypot proof of concept.
Honeypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot with plugins that can emulate TCP or UDP services and log activity. The project states it is no longer actively developed.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA simple web application honeypot that uses SimpleHTTPServer to serve a retro-styled HTML page, intended to attract and log basic web interactions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationDocker Compose configurations and scripts for deploying Honeysat components. The README links its submodules to a honeypot system but does not present the deployment repository itself as a honeypot.
Honeypot
Open software—
Material reviewed: Repository documentationExtensible SSH honeypot written in Go using crypto/ssh to accept connections and log failed login attempts, including usernames and passwords. It supports dropping process privileges and includes a Lua-based plugin engine to process captured information, plus a virtual filesystem to more convincingly emulate a system.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationSystem integrating multiple client honeypots and a crawler to process URLs and detect malicious websites.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationSSH honeypot that logs username and password attempts during brute-force attacks, rejecting them with a wrong-password message. Includes statsd, a simple HTTP API for querying login attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneypot that simulates a modem or router with a RomPager web server and TR-069 support; it documents vulnerability emulation and communication logging.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationhoneyTLS is a bash script that sets up Bro (Zeek) together with a JA3 script for Bro and Nginx, used as a simple honeypot to capture JA3 hashes (SSL/TLS client fingerprints). It also documents an alternative one-liner for skimming JA3 fingerprints directly off the wire.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction honeypot for attacks against TCP and UDP services; documents template-based emulation, mirror mode, and proxy mode.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingOpen framework for building and operating honeypot sensors.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction Python honeypot that mimics network services and ports and logs access attempts.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationPython 2.x Telnet honeypot that emulates the service in a chroot environment. The documentation describes options for credentials, a fake hostname, and command logging.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot with multiple virtual hosts, sandboxed filesystems, and commands that simulate interactions between hosts.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationhttpbl is a Python client package for the Project Honeypot Http:BL API, allowing queries of threat scores and visitor types for IP addresses.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot documented to log brute-force attacks and shell sessions, with a fake filesystem.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationAn instant messenger honeypot; the documentation only describes it as 'Instant messenger honeypot', without detailing protocols or detection mechanisms.
ApplicationNetworkHoneypot
Product—
Material reviewed: Public pageAn InnerWarden enterprise offering that, according to the vendor page, simulates a filesystem and Linux commands to interact with attackers. It is separate from the open-source innerwarden guardrail.
EndpointHoneypot
Product—
Material reviewed: Public pageCritical readingInsightIDR capabilities for honeypots, honey users, files and credentials; documentation describes interaction alerts.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationSimple honeypot for the Intel AMT port, inspired by a SANS ISC advisory about the risk of exposed AMT. It is intended to run alongside packet capture to log activity on the relevant ports.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationScripts to install a server and multiple honeypots, process their logs, and display information about attack attempts. The documentation lists SSH, web, and industrial-system honeypots.
NetworkApplicationHoneypot