Open software—
Material reviewed: Repository metadataCritical readingMulti-protocol network honeypot for detecting suspicious interactions inside networks.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA web backend (Tornado+Vue+Mysql+APScheduler+Nginx+Supervisor) providing a dashboard, host status, attack list, filter lists, and mail configuration to visualize and manage events detected by the OpenCanary honeypot.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationPHP (Zend/Laminas) module providing a contact form with anti-spam protection using a hidden honeypot field.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationOpen-source Python software designed for creating honeypot and honeynet setups in an easy and secure way, compatible with Python 3.x and tested on Mac OS X and Linux, with example modules for FTP, HTTP, and SSH deployed via containers.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationAPI honeypot whose server, according to the documentation, logs attempts to the API.log file.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationA Go tool that sets up a decoy (honeypot) port and executes a configurable command against every IP that connects to it, described by the author as suited for informal settings like conferences.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationPre-alpha honeypot daemon documented to filter and redirect SSH traffic to a protocol handler and then to a sandbox if the connection is accepted.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA lightweight package described as a minimal-interaction honeypot, combining a Python port-listening script with a PHP web backend to log incoming connections.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA script that uses Docker to quickly deploy several honeypots (Conpot, Cowrie, Heralding, Honeyaml, among others) exposing multiple services for research and reconnaissance.
NetworkOT/ICSHoneypot
Open software—
Material reviewed: Repository documentationHistorical project described by Honeynet as a high-interaction client honeypot for malicious-code execution detection and prevention.
Honeypot
Open software—
Material reviewed: Repository documentationRDP honeypot that assigns a virtual machine to each session and documents disk and traffic capture for BlueKeep telemetry.
NetworkHoneypot
Framework or guide—
Material reviewed: Repository documentationEducational project combining a Snort-based IPS on a software-defined network (SDN) with OpenFlow, capable of dynamically redirecting suspicious traffic to a honeypot server for analysis instead of outright blocking it.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationWeb application honeypot implemented as a Java servlet; documentation mentions GET/POST handling and a self-learning approach.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationWeb-application honeypot designed to detect attempts to exploit the Bash remote-code vulnerability CVE-2014-6271.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationProject described as a honeypot network. The supplied instructions cover startup and configuration of Snort, an alert rule, and MySQL, but do not explain how the honeypots operate.
NetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingReactive web honeypot component developed by the mushorg team.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationTool described as an open-relay simulator for spam capture and analysis.
NetworkHoneypot
Framework or guide—
Material reviewed: Repository documentationSpamtrap is a Rails gem that protects forms from spambots through opt-in, combinable mechanisms including hidden honeypot fields, nonces, field name mutation, and a minimum fill-time check.
ApplicationHoneypotDecoy
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot that logs incoming IP addresses, usernames, and passwords without allowing logins.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA C program that listens for incoming SSH connections and logs the IP address, username, and password used, written to gather rudimentary intelligence on brute force attacks.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA simple Python SSH server that logs all username/password combinations attempted against it to a logfile, intended to be deployed on a redirected port via iptables.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationModified OpenSSH daemon that forwards commands to Cowrie to interpret interactions and log brute-force attacks and SSH sessions.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationHigh-interaction SSH proxy described as a honeypot: it sits between a connecting party and a real SSH server and logs connections.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationLow-interaction SSH honeypot that accepts connections, records authentication attempts, and reports authentication failure.
NetworkHoneypot