mirror of
https://github.com/paralax/awesome-honeypots.git
synced 2024-10-01 06:35:45 -04:00
Merge pull request #69 from meitar/more-conformance-fixes
Additional awesome-list linting fixes, including:
This commit is contained in:
jose nazario
GitHub
commit
2fd654a266
299
README.md
299
README.md
@ -1,112 +1,111 @@
|
|||||||
# Awesome Honeypots
|
# Awesome Honeypots [](https://github.com/sindresorhus/awesome)
|
||||||
|
|
||||||
[](https://github.com/sindresorhus/awesome)
|
A curated list of awesome honeypots, plus related components and much more, divided into categories such as Web, services, and others, with a focus on free and open source projects.
|
||||||
|
|
||||||
A curated list of awesome honeypots, tools, components and much more. The list is divided into categories such as web, services, and others, focusing on open source projects.
|
|
||||||
|
|
||||||
There is no pre-established order of items in each category, the order is for contribution. If you want to contribute, please read the [guide](CONTRIBUTING.md).
|
There is no pre-established order of items in each category, the order is for contribution. If you want to contribute, please read the [guide](CONTRIBUTING.md).
|
||||||
|
|
||||||
Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindresorhus/awesome).
|
Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindresorhus/awesome).
|
||||||
|
|
||||||
### Sections
|
# Contents
|
||||||
|
|
||||||
|
- [Related Lists](#related-lists)
|
||||||
- [Honeypots](#honeypots)
|
- [Honeypots](#honeypots)
|
||||||
- [Honeyd Tools](#honeyd)
|
- [Honeyd Tools](#honeyd-tools)
|
||||||
- [Network and Artifact Analysis](#analysis)
|
- [Network and Artifact Analysis](#network-and-artifact-analysis)
|
||||||
- [Data Tools](#visualizers)
|
- [Data Tools](#data-tools)
|
||||||
- [Guides](#guides)
|
- [Guides](#guides)
|
||||||
|
|
||||||
## Related Lists
|
## Related Lists
|
||||||
- [awesome-pcaptools](https://github.com/caesar0301/awesome-pcaptools), useful in network traffic analysis.
|
|
||||||
- [awesome-malware-analysis](https://github.com/rshipp/awesome-malware-analysis), with some overlap here for artifact analysis.
|
|
||||||
|
|
||||||
## <a name="honeypots"></a> Honeypots
|
- [awesome-pcaptools](https://github.com/caesar0301/awesome-pcaptools) - Useful in network traffic analysis.
|
||||||
|
- [awesome-malware-analysis](https://github.com/rshipp/awesome-malware-analysis) - Some overlap here for artifact analysis.
|
||||||
|
|
||||||
|
## Honeypots
|
||||||
|
|
||||||
- Database Honeypots
|
- Database Honeypots
|
||||||
- [Delilah](https://github.com/Novetta/delilah) - An Elasticsearch Honeypot written in Python.
|
- [Delilah](https://github.com/Novetta/delilah) - Elasticsearch Honeypot written in Python.
|
||||||
- [ESPot](https://github.com/mycert/ESPot) - An Elasticsearch honeypot written in NodeJS, to capture every attempts to exploit CVE-2014-3120.
|
- [ESPot](https://github.com/mycert/ESPot) - Elasticsearch honeypot written in NodeJS, to capture every attempts to exploit CVE-2014-3120.
|
||||||
- [Elastic honey](https://github.com/jordan-wright/elastichoney) - A Simple Elasticsearch Honeypot.
|
- [Elastic honey](https://github.com/jordan-wright/elastichoney) - Simple Elasticsearch Honeypot.
|
||||||
- [HoneyMysql](https://github.com/xiaoxiaoleo/HoneyMysql) - A simple Mysql honeypot project.
|
- [HoneyMysql](https://github.com/xiaoxiaoleo/HoneyMysql) - Simple Mysql honeypot project.
|
||||||
- [MongoDB-HoneyProxy](https://github.com/Plazmaz/MongoDB-HoneyProxy) - A MongoDB honeypot proxy.
|
- [MongoDB-HoneyProxy](https://github.com/Plazmaz/MongoDB-HoneyProxy) - MongoDB honeypot proxy.
|
||||||
- [NoSQLpot](https://github.com/torque59/nosqlpot) - The NoSQL Honeypot Framework.
|
- [NoSQLpot](https://github.com/torque59/nosqlpot) - Honeypot framework built on a NoSQL-style database.
|
||||||
- [mysql-honeypotd](https://github.com/sjinks/mysql-honeypotd) - Low interaction MySQL honeypot written in C.
|
- [mysql-honeypotd](https://github.com/sjinks/mysql-honeypotd) - Low interaction MySQL honeypot written in C.
|
||||||
- [MysqlPot](https://github.com/schmalle/MysqlPot) - A mysql honeypot, still very very early stage.
|
- [MysqlPot](https://github.com/schmalle/MysqlPot) - MySQL honeypot, still very early stage.
|
||||||
- [pghoney](https://github.com/betheroot/pghoney) - Low-interaction Postgres Honeypot.
|
- [pghoney](https://github.com/betheroot/pghoney) - Low-interaction Postgres Honeypot.
|
||||||
- [sticky_elephant](https://github.com/betheroot/sticky_elephant) - medium interaction postgresql honeypot.
|
- [sticky_elephant](https://github.com/betheroot/sticky_elephant) - Medium interaction postgresql honeypot.
|
||||||
|
|
||||||
- Web honeypots
|
- Web honeypots
|
||||||
- [Bukkit Honeypot](https://github.com/Argomirr/Honeypot) Honeypot - A honeypot plugin for Bukkit.
|
- [Bukkit Honeypot](https://github.com/Argomirr/Honeypot) - Honeypot plugin for Bukkit.
|
||||||
- [EoHoneypotBundle](https://github.com/eymengunay/EoHoneypotBundle) - Honeypot type for Symfony2 forms.
|
- [EoHoneypotBundle](https://github.com/eymengunay/EoHoneypotBundle) - Honeypot type for Symfony2 forms.
|
||||||
- [Glastopf](https://github.com/mushorg/glastopf) - Web Application Honeypot.
|
- [Glastopf](https://github.com/mushorg/glastopf) - Web Application Honeypot.
|
||||||
- [Google Hack Honeypot](http://ghh.sourceforge.net) - designed to provide reconnaissance against attackers that use search engines as a hacking tool against your resources.
|
- [Google Hack Honeypot](http://ghh.sourceforge.net) - Designed to provide reconnaissance against attackers that use search engines as a hacking tool against your resources.
|
||||||
- [Laravel Application Honeypot](https://github.com/msurguy/Honeypot) - Honeypot - Simple spam prevention package for Laravel applications.
|
- [Laravel Application Honeypot](https://github.com/msurguy/Honeypot) - Simple spam prevention package for Laravel applications.
|
||||||
- [Nodepot](https://github.com/schmalle/Nodepot) - A nodejs web application honeypot.
|
- [Nodepot](https://github.com/schmalle/Nodepot) - NodeJS web application honeypot.
|
||||||
- [Servletpot](https://github.com/schmalle/servletpot) - Web application Honeypot.
|
- [Servletpot](https://github.com/schmalle/servletpot) - Web application Honeypot.
|
||||||
- [Shadow Daemon](https://shadowd.zecure.org/overview/introduction/) - A modular Web Application Firewall / High-Interaction Honeypot for PHP, Perl & Python apps.
|
- [Shadow Daemon](https://shadowd.zecure.org/overview/introduction/) - Modular Web Application Firewall / High-Interaction Honeypot for PHP, Perl, and Python apps.
|
||||||
- [StrutsHoneypot](https://github.com/Cymmetria/StrutsHoneypot) - Struts Apache 2 based honeypot as well as a detection module for Apache 2 servers
|
- [StrutsHoneypot](https://github.com/Cymmetria/StrutsHoneypot) - Struts Apache 2 based honeypot as well as a detection module for Apache 2 servers.
|
||||||
- [WebTrap](https://github.com/IllusiveNetworks-Labs/WebTrap) - Designed to create deceptive webpages to deceive and redirect attackers away from real websites.
|
- [WebTrap](https://github.com/IllusiveNetworks-Labs/WebTrap) - Designed to create deceptive webpages to deceive and redirect attackers away from real websites.
|
||||||
- [basic-auth-pot](https://github.com/bjeborn/basic-auth-pot) bap - http Basic Authentication honeyPot.
|
- [basic-auth-pot (bap)](https://github.com/bjeborn/basic-auth-pot) - HTTP Basic Authentication honeypot.
|
||||||
- [django-admin-honeypot](https://github.com/dmpayton/django-admin-honeypot) - A fake Django admin login screen to notify admins of attempted unauthorized access.
|
- [django-admin-honeypot](https://github.com/dmpayton/django-admin-honeypot) - Fake Django admin login screen to notify admins of attempted unauthorized access.
|
||||||
- [honeyhttpd](https://github.com/bocajspear1/honeyhttpd) - a Python-based web server honeypot builder.
|
- [honeyhttpd](https://github.com/bocajspear1/honeyhttpd) - Python-based web server honeypot builder.
|
||||||
- [phpmyadmin_honeypot](https://github.com/gfoss/phpmyadmin_honeypot) - - A simple and effective phpMyAdmin honeypot.
|
- [phpmyadmin_honeypot](https://github.com/gfoss/phpmyadmin_honeypot) - Simple and effective phpMyAdmin honeypot.
|
||||||
- [shockpot](https://github.com/threatstream/shockpot) - WebApp Honeypot for detecting Shell Shock exploit attempts.
|
- [shockpot](https://github.com/threatstream/shockpot) - WebApp Honeypot for detecting Shell Shock exploit attempts.
|
||||||
- [smart-honeypot](https://github.com/freak3dot/smart-honeypot) - PHP Script demonstrating a smart honey pot.
|
- [smart-honeypot](https://github.com/freak3dot/smart-honeypot) - PHP Script demonstrating a smart honey pot.
|
||||||
- Snare/Tanner - successors to Glastopf
|
- Snare/Tanner - successors to Glastopf
|
||||||
- [Snare](https://github.com/mushorg/snare) - Super Next generation Advanced Reactive honEypot
|
- [Snare](https://github.com/mushorg/snare) - Super Next generation Advanced Reactive honeypot.
|
||||||
- [Tanner](https://github.com/mushorg/tanner) - Evaluating SNARE events
|
- [Tanner](https://github.com/mushorg/tanner) - Evaluating SNARE events.
|
||||||
- [stack-honeypot](https://github.com/CHH/stack-honeypot) - Inserts a trap for spam bots into responses.
|
- [stack-honeypot](https://github.com/CHH/stack-honeypot) - Inserts a trap for spam bots into responses.
|
||||||
- WordPress honeypots
|
- WordPress honeypots
|
||||||
- [HonnyPotter](https://github.com/MartinIngesen/HonnyPotter) - A WordPress login honeypot for collection and analysis of failed login attempts.
|
- [HonnyPotter](https://github.com/MartinIngesen/HonnyPotter) - WordPress login honeypot for collection and analysis of failed login attempts.
|
||||||
- [HoneyPress](https://github.com/dustyfresh/HoneyPress) - python based WordPress honeypot in a docker container.
|
- [HoneyPress](https://github.com/dustyfresh/HoneyPress) - Python based WordPress honeypot in a Docker container.
|
||||||
- [wp-smart-honeypot](https://github.com/freak3dot/wp-smart-honeypot) - WordPress plugin to reduce comment spam with a smarter honeypot.
|
- [wp-smart-honeypot](https://github.com/freak3dot/wp-smart-honeypot) - WordPress plugin to reduce comment spam with a smarter honeypot.
|
||||||
- [wordpot](https://github.com/gbrindisi/wordpot) - A WordPress Honeypot.
|
- [wordpot](https://github.com/gbrindisi/wordpot) - WordPress Honeypot.
|
||||||
|
|
||||||
- Service Honeypots
|
- Service Honeypots
|
||||||
- [AMTHoneypot](https://github.com/packetflare/amthoneypot) - Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689.
|
- [AMTHoneypot](https://github.com/packetflare/amthoneypot) - Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689.
|
||||||
- [Ensnare](https://github.com/ahoernecke/ensnare) - Easy to deploy Ruby honeypot.
|
- [Ensnare](https://github.com/ahoernecke/ensnare) - Easy to deploy Ruby honeypot.
|
||||||
- [HoneyPy](https://github.com/foospidy/HoneyPy) - A low interaction honeypot.
|
- [HoneyPy](https://github.com/foospidy/HoneyPy) - Low interaction honeypot.
|
||||||
- [Honeygrove](https://github.com/UHH-ISS/honeygrove) - A multi-purpose modular honeypot based on Twisted.
|
- [Honeygrove](https://github.com/UHH-ISS/honeygrove) - Multi-purpose modular honeypot based on Twisted.
|
||||||
- [Honeyport](https://github.com/securitygeneration/Honeyport) - A simple honeyport written in Bash and Python.
|
- [Honeyport](https://github.com/securitygeneration/Honeyport) - Simple honeyport written in Bash and Python.
|
||||||
- [Honeyprint](https://github.com/glaslos/honeyprint) - Printer honeypot.
|
- [Honeyprint](https://github.com/glaslos/honeyprint) - Printer honeypot.
|
||||||
- [Lyrebird](https://hub.docker.com/r/lyrebird/honeypot-base/) - A modern high-interaction honeypot framework.
|
- [Lyrebird](https://hub.docker.com/r/lyrebird/honeypot-base/) - Modern high-interaction honeypot framework.
|
||||||
- [MICROS honeypot](https://github.com/Cymmetria/micros_honeypot) - low interaction honeypot to detect CVE-2018-2636 in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (MICROS).
|
- [MICROS honeypot](https://github.com/Cymmetria/micros_honeypot) - Low interaction honeypot to detect CVE-2018-2636 in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (MICROS).
|
||||||
- [RDPy](https://github.com/citronneur/rdpy) - A Microsoft Remote Desktop Protocol (RDP) honeypot in python.
|
- [RDPy](https://github.com/citronneur/rdpy) - Microsoft Remote Desktop Protocol (RDP) honeypot implemented in Python.
|
||||||
- [SMB Honeypot](https://github.com/r0hi7/HoneySMB) - High interaction SMB service Honeypot capable of capturing wannacry like Malware.
|
- [SMB Honeypot](https://github.com/r0hi7/HoneySMB) - High interaction SMB service honeypot capable of capturing wannacry-like Malware.
|
||||||
- [Tom's Honeypot](https://github.com/inguardians/toms_honeypot) - Low interaction Python honeypot.
|
- [Tom's Honeypot](https://github.com/inguardians/toms_honeypot) - Low interaction Python honeypot.
|
||||||
- [WebLogic honeypot](https://github.com/Cymmetria/weblogic_honeypot) - low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware.
|
- [WebLogic honeypot](https://github.com/Cymmetria/weblogic_honeypot) - Low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware.
|
||||||
- [WhiteFace Honeypot](https://github.com/csirtgadgets/csirtg-honeypot) - Twisted based HoneyPot for WhiteFace whiteface.csirtgadgets.com
|
- [WhiteFace Honeypot](https://github.com/csirtgadgets/csirtg-honeypot) - Twisted based honeypot for WhiteFace.
|
||||||
- [honeycomb_plugins](https://github.com/Cymmetria/honeycomb_plugins) - The plugin repository for Honeycomb, the honeypot framework by Cymmetria.
|
- [honeycomb_plugins](https://github.com/Cymmetria/honeycomb_plugins) - Plugin repository for Honeycomb, the honeypot framework by Cymmetria.
|
||||||
- [honeyntp](https://github.com/fygrave/honeyntp) - NTP logger/honeypot.
|
- [honeyntp](https://github.com/fygrave/honeyntp) - NTP logger/honeypot.
|
||||||
- [honeypot-camera](https://github.com/alexbredo/honeypot-camera) - observation camera honeypot.
|
- [honeypot-camera](https://github.com/alexbredo/honeypot-camera) - Observation camera honeypot.
|
||||||
- [honeytrap](https://github.com/honeytrap/honeytrap) - Advanced Honeypot framework written in Go. Can be connected up with other Honeypot software.
|
- [honeytrap](https://github.com/honeytrap/honeytrap) - Advanced Honeypot framework written in Go that can be connected with other honeypot software.
|
||||||
- [troje](https://github.com/dutchcoders/troje/) - a honeypot built around lxc containers. It will run each connection with the service within a seperate lxc container.
|
- [troje](https://github.com/dutchcoders/troje/) - Honeypot that runs each connection with the service within a seperate LXC container.
|
||||||
|
|
||||||
- Distributed Honeypots
|
- Distributed Honeypots
|
||||||
- [DemonHunter](https://github.com/RevengeComing/DemonHunter) - Low interaction Honepot Server.
|
- [DemonHunter](https://github.com/RevengeComing/DemonHunter) - Low interaction honeypot server.
|
||||||
|
|
||||||
- Anti-honeypot stuff
|
- Anti-honeypot stuff
|
||||||
- [kippo_detect](https://github.com/andrew-morris/kippo_detect) - This is not a honeypot, but it detects kippo. (This guy has lots of more interesting stuff)
|
- [kippo_detect](https://github.com/andrew-morris/kippo_detect) - Offensive component that detects the presence of the kippo honeypot.
|
||||||
|
|
||||||
- ICS/SCADA honeypots
|
- ICS/SCADA honeypots
|
||||||
- [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA honeypot.
|
- [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA honeypot.
|
||||||
- [GasPot](https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, common in the oil and gas industry.
|
- [GasPot](https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, common in the oil and gas industry.
|
||||||
- [SCADA honeynet](http://scadahoneynet.sourceforge.net) - Building Honeypots for Industrial Networks.
|
- [SCADA honeynet](http://scadahoneynet.sourceforge.net) - Building Honeypots for Industrial Networks.
|
||||||
- [gridpot](https://github.com/sk4ld/gridpot) - Open source tools for realistic-behaving electric grid honeynets .
|
- [gridpot](https://github.com/sk4ld/gridpot) - Open source tools for realistic-behaving electric grid honeynets.
|
||||||
- [scada-honeynet](http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/) - mimics many of the services from a popular PLC and better helps SCADA researchers understand potential risks of exposed control system devices.
|
- [scada-honeynet](http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/) - Mimics many of the services from a popular PLC and better helps SCADA researchers understand potential risks of exposed control system devices.
|
||||||
|
|
||||||
- Other/random
|
- Other/random
|
||||||
- [DSHP](https://github.com/naorlivne/dshp) - Damn Simple HoneyPot with pluggable handlers.
|
- [Damn Simple Honeypot (DSHP)](https://github.com/naorlivne/dshp) - Honeypot framework with pluggable handlers.
|
||||||
- [NOVA](https://github.com/DataSoft/Nova) uses honeypots as detectors, looks like a complete system.
|
- [NOVA](https://github.com/DataSoft/Nova) - Uses honeypots as detectors, looks like a complete system.
|
||||||
- [OFPot](https://github.com/upa/ofpot) - OpenFlow Honeypot, redirects traffic for unused IPs to a honeypot. Built on POX.
|
- [OpenFlow Honeypot (OFPot)](https://github.com/upa/ofpot) - Redirects traffic for unused IPs to a honeypot, built on POX.
|
||||||
- [Open Canary](https://pypi.org/project/opencanary/) - A low interaction honeypot intended to be run on internal networks.
|
- [OpenCanary](https://github.com/thinkst/opencanary) - Modular and decentralised honeypot daemon that runs several canary versions of services that alerts when a service is (ab)used.
|
||||||
- [OpenCanary](https://github.com/thinkst/opencanary) - Modular and decentralised honeypot.
|
|
||||||
|
|
||||||
- Botnet C2 tools
|
- Botnet C2 tools
|
||||||
- [Hale](https://github.com/pjlantz/Hale) - Botnet command & control monitor.
|
- [Hale](https://github.com/pjlantz/Hale) - Botnet command and control monitor.
|
||||||
- [dnsMole](https://code.google.com/archive/p/dns-mole/) - analyse dns traffic, and to potentionaly detect botnet C&C server and infected hosts.
|
- [dnsMole](https://code.google.com/archive/p/dns-mole/) - Analyses DNS traffic and potentionaly detect botnet command and control server activity, along with infected hosts.
|
||||||
|
|
||||||
- IPv6 attack detection tool
|
- IPv6 attack detection tool
|
||||||
- [ipv6-attack-detector](https://github.com/mzweilin/ipv6-attack-detector/) - Google Summer of Code 2012 project, supported by The Honeynet Project organization.
|
- [ipv6-attack-detector](https://github.com/mzweilin/ipv6-attack-detector/) - Google Summer of Code 2012 project, supported by The Honeynet Project organization.
|
||||||
|
|
||||||
- Dynamic code instrumentation toolkit
|
- Dynamic code instrumentation toolkit
|
||||||
- [Frida](https://www.frida.re) - Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android.
|
- [Frida](https://www.frida.re) - Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android.
|
||||||
@ -118,136 +117,136 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
|
|||||||
- [Kippo-Malware](https://bruteforcelab.com/kippo-malware) - Python script that will download all malicious files stored as URLs in a Kippo SSH honeypot database.
|
- [Kippo-Malware](https://bruteforcelab.com/kippo-malware) - Python script that will download all malicious files stored as URLs in a Kippo SSH honeypot database.
|
||||||
|
|
||||||
- Distributed sensor deployment
|
- Distributed sensor deployment
|
||||||
- [ADHD](https://sourceforge.net/projects/adhd/) - Active Defense Harbinger Distribution (ADHD) is a Linux distro based on Ubuntu LTS. It comes with many tools aimed at active defense preinstalled and configured.
|
- [Active Defense Harbinger Distribution (ADHD)](https://sourceforge.net/projects/adhd/) - GNU/Linux distro based on Ubuntu LTS that comes with many tools aimed at active defense preinstalled and configured.
|
||||||
- [Modern Honey Network](https://github.com/threatstream/mhn) - Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management.
|
- [Modern Honey Network](https://github.com/threatstream/mhn) - Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management.
|
||||||
- [Smarthoneypot](https://smarthoneypot.com/) - custom honeypot intelligence system that is simple to deploy and easy to manage.
|
- [Smarthoneypot](https://smarthoneypot.com/) - Custom honeypot intelligence system that is simple to deploy and easy to manage.
|
||||||
|
|
||||||
- Network Analysis Tool
|
- Network Analysis Tool
|
||||||
- [Tracexploit](https://code.google.com/archive/p/tracexploit/) - replay network packets.
|
- [Tracexploit](https://code.google.com/archive/p/tracexploit/) - Replay network packets.
|
||||||
|
|
||||||
- Log anonymizer
|
- Log anonymizer
|
||||||
- [LogAnon](http://code.google.com/archive/p/loganon/) - log anonymization library that helps having anonymous logs consistent between logs and network captures.
|
- [LogAnon](http://code.google.com/archive/p/loganon/) - Log anonymization library that helps having anonymous logs consistent between logs and network captures.
|
||||||
|
|
||||||
- Low interaction honeypot (router back door)
|
- Low interaction honeypot (router back door)
|
||||||
- [Honeypot-32764](https://github.com/knalli/honeypot-for-tcp-32764) - Honeypot for router backdoor (TCP 32764).
|
- [Honeypot-32764](https://github.com/knalli/honeypot-for-tcp-32764) - Honeypot for router backdoor (TCP 32764).
|
||||||
|
|
||||||
- honeynet farm traffic redirector
|
- honeynet farm traffic redirector
|
||||||
- [Honeymole](https://web.archive.org/web/20100326040550/http://www.honeynet.org.pt:80/index.php/HoneyMole) - eploy multiple sensors that redirect traffic to a centralized collection of honeypots.
|
- [Honeymole](https://web.archive.org/web/20100326040550/http://www.honeynet.org.pt:80/index.php/HoneyMole) - Deploy multiple sensors that redirect traffic to a centralized collection of honeypots.
|
||||||
|
|
||||||
- HTTPS Proxy
|
- HTTPS Proxy
|
||||||
- [mitmproxy](https://mitmproxy.org/) - allows traffic flows to be intercepted, inspected, modified and replayed.
|
- [mitmproxy](https://mitmproxy.org/) - Allows traffic flows to be intercepted, inspected, modified, and replayed.
|
||||||
|
|
||||||
- System instrumentation
|
- System instrumentation
|
||||||
- [Sysdig](https://sysdig.com/opensource/) - open source, system-level exploration: capture system state and activity from a running Linux instance, then save, filter and analyze.
|
- [Sysdig](https://sysdig.com/opensource/) - Open source, system-level exploration allows one to capture system state and activity from a running GNU/Linux instance, then save, filter, and analyze the results.
|
||||||
- [Fibratus](https://github.com/rabbitstack/fibratus) - tool for exploration and tracing of the Windows kernel.
|
- [Fibratus](https://github.com/rabbitstack/fibratus) - Tool for exploration and tracing of the Windows kernel.
|
||||||
|
|
||||||
- Honeypot for USB-spreading malware
|
- Honeypot for USB-spreading malware
|
||||||
- [Ghost-usb](https://github.com/honeynet/ghost-usb-honeypot) - honeypot for malware that propagates via USB storage devices.
|
- [Ghost-usb](https://github.com/honeynet/ghost-usb-honeypot) - Honeypot for malware that propagates via USB storage devices.
|
||||||
- [Honeystick](http://www.ukhoneynet.org/research/honeystick-howto/) - low interaction honeypot on USB stick
|
- [Honeystick](http://www.ukhoneynet.org/research/honeystick-howto/) - Low interaction honeypot on USB stick.
|
||||||
|
|
||||||
- Data Collection
|
- Data Collection
|
||||||
- [Kippo2MySQL](https://bruteforcelab.com/kippo2mysql) - extracts some very basic stats from Kippo’s text-based log files (a mess to analyze!) and inserts them in a MySQL database.
|
- [Kippo2MySQL](https://bruteforcelab.com/kippo2mysql) - Extracts some very basic stats from Kippo’s text-based log files and inserts them in a MySQL database.
|
||||||
- [Kippo2ElasticSearch](https://bruteforcelab.com/kippo2elasticsearch) - Python script to transfer data from a Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster).
|
- [Kippo2ElasticSearch](https://bruteforcelab.com/kippo2elasticsearch) - Python script to transfer data from a Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster).
|
||||||
|
|
||||||
- Passive network audit framework parser
|
- Passive network audit framework parser
|
||||||
- [pnaf](https://github.com/jusafing/pnaf) - Passive Network Audit Framework.
|
- [Passive Network Audit Framework (pnaf)](https://github.com/jusafing/pnaf) - Framework that combines multiple passive and automated analysis techniques in order to provide a security assessment of network platforms.
|
||||||
|
|
||||||
- VM monitoring and tools
|
- VM monitoring and tools
|
||||||
- [Antivmdetect](https://github.com/nsmfoo/antivmdetection) - Script to create templates to use with VirtualBox to make vm detection harder.
|
- [Antivmdetect](https://github.com/nsmfoo/antivmdetection) - Script to create templates to use with VirtualBox to make VM detection harder.
|
||||||
- [VMCloak](https://github.com/jbremer/vmcloak) - Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
|
- [VMCloak](https://github.com/jbremer/vmcloak) - Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
|
||||||
- [vmitools](http://libvmi.com/) - C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine.
|
- [vmitools](http://libvmi.com/) - C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine.
|
||||||
|
|
||||||
- Binary debugger
|
- Binary debugger
|
||||||
- [Hexgolems - Pint Debugger Backend](https://github.com/hexgolems/pint) - A debugger backend and LUA wrapper for PIN.
|
- [Hexgolems - Pint Debugger Backend](https://github.com/hexgolems/pint) - Debugger backend and LUA wrapper for PIN.
|
||||||
- [Hexgolems - Schem Debugger Frontend](https://github.com/hexgolems/schem) - A debugger frontend.
|
- [Hexgolems - Schem Debugger Frontend](https://github.com/hexgolems/schem) - Debugger frontend.
|
||||||
|
|
||||||
- Mobile Analysis Tool
|
- Mobile Analysis Tool
|
||||||
- [Androguard](https://github.com/androguard/androguard) - Reverse engineering, Malware and goodware analysis of Android applications ... and more.
|
- [Androguard](https://github.com/androguard/androguard) - Reverse engineering, Malware and goodware analysis of Android applications and more.
|
||||||
- [APKinspector](https://github.com/honeynet/apkinspector/) - APKinspector is a powerful GUI tool for analysts to analyze the Android applications.
|
- [APKinspector](https://github.com/honeynet/apkinspector/) - Powerful GUI tool for analysts to analyze the Android applications.
|
||||||
|
|
||||||
- Low interaction honeypot
|
- Low interaction honeypot
|
||||||
- [Honeyperl](https://sourceforge.net/projects/honeyperl/) - Honeypot software based in Perl with plugins developed for many functions like : wingates, telnet, squid, smtp, etc.
|
- [Honeyperl](https://sourceforge.net/projects/honeyperl/) - Honeypot software based in Perl with plugins developed for many functions like : wingates, telnet, squid, smtp, etc.
|
||||||
|
|
||||||
- Honeynet data fusion
|
- Honeynet data fusion
|
||||||
- [HFlow2](https://projects.honeynet.org/hflow) - data coalesing tool for honeynet/network analysis.
|
- [HFlow2](https://projects.honeynet.org/hflow) - Data coalesing tool for honeynet/network analysis.
|
||||||
|
|
||||||
- Server
|
- Server
|
||||||
- [Amun](http://amunhoney.sourceforge.net) - vulnerability emulation honeypot.
|
- [Amun](http://amunhoney.sourceforge.net) - Vulnerability emulation honeypot.
|
||||||
- [Artillery](https://github.com/trustedsec/artillery/) - open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
|
- [Artillery](https://github.com/trustedsec/artillery/) - Open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
|
||||||
- [Bait and Switch](http://baitnswitch.sourceforge.net) - redirects all hostile traffic to a honeypot that is partially mirroring your production system.
|
- [Bait and Switch](http://baitnswitch.sourceforge.net) - Redirects all hostile traffic to a honeypot that is partially mirroring your production system.
|
||||||
- [Bifrozt](https://github.com/Ziemeck/bifrozt-ansible) - Automatic deploy bifrozt with ansible.
|
- [Bifrozt](https://github.com/Ziemeck/bifrozt-ansible) - Automatic deploy bifrozt with ansible.
|
||||||
- [Conpot](http://conpot.org/) - ow interactive server side Industrial Control Systems honeypot.
|
- [Conpot](http://conpot.org/) - Low interactive server side Industrial Control Systems honeypot.
|
||||||
- [Heralding](https://github.com/johnnykv/heralding) - A credentials catching honeypot.
|
- [Heralding](https://github.com/johnnykv/heralding) - Credentials catching honeypot.
|
||||||
- [HoneyWRT](https://github.com/CanadianJeff/honeywrt) - low interaction Python honeypot designed to mimic services or ports that might get targeted by attackers.
|
- [HoneyWRT](https://github.com/CanadianJeff/honeywrt) - Low interaction Python honeypot designed to mimic services or ports that might get targeted by attackers.
|
||||||
- [Honeyd](https://github.com/provos/honeyd) Also see [more honeyd tools](#honeyd).
|
- [Honeyd](https://github.com/provos/honeyd) - See [honeyd tools](#honeyd-tools).
|
||||||
- [Honeysink](http://www.honeynet.org/node/773) - open source network sinkhole that provides a mechanism for detection and prevention of malicious traffic on a given network.
|
- [Honeysink](http://www.honeynet.org/node/773) - Open source network sinkhole that provides a mechanism for detection and prevention of malicious traffic on a given network.
|
||||||
- [Hontel](https://github.com/stamparm/hontel) - Telnet Honeypot.
|
- [Hontel](https://github.com/stamparm/hontel) - Telnet Honeypot.
|
||||||
- [KFSensor](http://www.keyfocus.net/kfsensor/) - Windows based honeypot Intrusion Detection System (IDS).
|
- [KFSensor](http://www.keyfocus.net/kfsensor/) - Windows based honeypot Intrusion Detection System (IDS).
|
||||||
- [LaBrea](http://labrea.sourceforge.net/labrea-info.html) - takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet.
|
- [LaBrea](http://labrea.sourceforge.net/labrea-info.html) - Takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet.
|
||||||
- [MTPot](https://github.com/Cymmetria/MTPot) - Open Source Telnet Honeypot, focused on Mirai malware.
|
- [MTPot](https://github.com/Cymmetria/MTPot) - Open Source Telnet Honeypot, focused on Mirai malware.
|
||||||
- [SIREN](https://github.com/blaverick62/SIREN) - Semi-Intelligent HoneyPot Network - HoneyNet Intelligent Virtual Environment.
|
- [SIREN](https://github.com/blaverick62/SIREN) - Semi-Intelligent HoneyPot Network - HoneyNet Intelligent Virtual Environment.
|
||||||
- [TelnetHoney](https://github.com/balte/TelnetHoney) - A simple telnet honeypot.
|
- [TelnetHoney](https://github.com/balte/TelnetHoney) - Simple telnet honeypot.
|
||||||
- [UDPot Honeypot](https://github.com/jekil/UDPot) - Simple UDP / DNS honeypot scripts.
|
- [UDPot Honeypot](https://github.com/jekil/UDPot) - Simple UDP/DNS honeypot scripts.
|
||||||
- [YAFH](https://github.com/fnzv/YAFH) - Yet Another Fake Honeypot written in Go
|
- [Yet Another Fake Honeypot (YAFH)](https://github.com/fnzv/YAFH) - Simple honeypot written in Go.
|
||||||
- [arctic-swallow](https://github.com/ajackal/arctic-swallow) - a low interaction honeypot.
|
- [arctic-swallow](https://github.com/ajackal/arctic-swallow) - Low interaction honeypot.
|
||||||
- [glutton](https://github.com/mushorg/glutton) - All eating honeypot.
|
- [glutton](https://github.com/mushorg/glutton) - All eating honeypot.
|
||||||
- [go-HoneyPot](https://github.com/Mojachieee/go-HoneyPot) - A honeypot server written in Go
|
- [go-HoneyPot](https://github.com/Mojachieee/go-HoneyPot) - Honeypot server written in Go.
|
||||||
- [go-emulators](https://github.com/kingtuna/go-emulators) - honeypot go lang emulators
|
- [go-emulators](https://github.com/kingtuna/go-emulators) - Honeypot Golang emulators.
|
||||||
- [honeymail](https://github.com/sec51/honeymail) - SMTP honeypot written in Golang
|
- [honeymail](https://github.com/sec51/honeymail) - SMTP honeypot written in Golang.
|
||||||
- [honeytrap](https://github.com/tillmannw/honeytrap) - a low-interaction honeypot and network security tool written to catch attacks against TCP and UDP services.
|
- [honeytrap](https://github.com/tillmannw/honeytrap) - Low-interaction honeypot and network security tool written to catch attacks against TCP and UDP services.
|
||||||
- [imap-honey](https://github.com/yvesago/imap-honey) - IMAP honeypot written in Golang
|
- [imap-honey](https://github.com/yvesago/imap-honey) - IMAP honeypot written in Golang.
|
||||||
- [mwcollectd](https://www.openhub.net/p/mwcollectd) - a versatile malware collection daemon, uniting the best features of nepenthes and honeytrap.
|
- [mwcollectd](https://www.openhub.net/p/mwcollectd) - Versatile malware collection daemon, uniting the best features of nepenthes and honeytrap.
|
||||||
- [potd](https://github.com/lnslbrty/potd) - A high scalable low to medium interactive SSH/TCP honeypot designed for OpenWrt/IoT devices using Linux Namespaces, Seccomp and Capabilities.
|
- [potd](https://github.com/lnslbrty/potd) - Highly scalable low- to medium-interaction SSH/TCP honeypot designed for OpenWrt/IoT devices leveraging several Linux kernel features, such as namespaces, seccomp and thread capabilities.
|
||||||
- [portlurker](https://github.com/bartnv/portlurker) - Port listener / honeypot in Rust with protocol guessing and safe string display.
|
- [portlurker](https://github.com/bartnv/portlurker) - Port listener in Rust with protocol guessing and safe string display.
|
||||||
- [slipm-honeypot](https://github.com/rshipp/slipm-honeypot) - A simple low-interaction port monitoring honeypot.
|
- [slipm-honeypot](https://github.com/rshipp/slipm-honeypot) - Simple low-interaction port monitoring honeypot.
|
||||||
- [telnetlogger](https://github.com/robertdavidgraham/telnetlogger) - A Telnet honeypot designed to track the Mirai botnet.
|
- [telnetlogger](https://github.com/robertdavidgraham/telnetlogger) - Telnet honeypot designed to track the Mirai botnet.
|
||||||
- [vnclowpot](https://github.com/magisterquis/vnclowpot) - A low interaction VNC honeypot.
|
- [vnclowpot](https://github.com/magisterquis/vnclowpot) - Low interaction VNC honeypot.
|
||||||
|
|
||||||
|
|
||||||
- IDS signature generation
|
- IDS signature generation
|
||||||
- [Honeycomb](http://www.icir.org/christian/honeycomb/) - Automated signature creation using honeypots.
|
- [Honeycomb](http://www.icir.org/christian/honeycomb/) - Automated signature creation using honeypots.
|
||||||
|
|
||||||
- Lookup service for AS-numbers and prefixes
|
- Lookup service for AS-numbers and prefixes
|
||||||
- [CC2ASN](http://www.cc2asn.com/) - A simple lookup service for AS-numbers and prefixes belonging to any given country in the world.
|
- [CC2ASN](http://www.cc2asn.com/) - Simple lookup service for AS-numbers and prefixes belonging to any given country in the world.
|
||||||
|
|
||||||
- Data Collection / Data Sharing
|
- Data Collection / Data Sharing
|
||||||
- [HPfriends](http://hpfriends.honeycloud.net/#/home) - Honeypot data-sharing platform.
|
- [HPfriends](http://hpfriends.honeycloud.net/#/home) - Honeypot data-sharing platform.
|
||||||
- [hpfriends - real-time social data-sharing](http://heipei.github.io/sigint-hpfriends/) - Presentation about HPFriends feed system
|
- [hpfriends - real-time social data-sharing](http://heipei.github.io/sigint-hpfriends/) - Presentation about HPFriends feed system
|
||||||
- [HPFeeds](https://github.com/rep/hpfeeds/) - lightweight authenticated publish-subscribe protocol.
|
- [HPFeeds](https://github.com/rep/hpfeeds/) - Lightweight authenticated publish-subscribe protocol.
|
||||||
|
|
||||||
- central management tool
|
- Central management tool
|
||||||
- [PHARM](http://www.nepenthespharm.com/) - Manage , Report, Analyze your distributed Nepenthes instances.
|
- [PHARM](http://www.nepenthespharm.com/) - Manage, report, and analyze your distributed Nepenthes instances.
|
||||||
|
|
||||||
- Network connection analyzer
|
- Network connection analyzer
|
||||||
- [Impost](http://impost.sourceforge.net/) - a network security auditing tool designed to analyze the forensics behind compromised and/or vulnerable daemons.
|
- [Impost](http://impost.sourceforge.net/) - Network security auditing tool designed to analyze the forensics behind compromised and/or vulnerable daemons.
|
||||||
|
|
||||||
- Honeypot deployment
|
- Honeypot deployment
|
||||||
- [Modern Honeynet Network](http://threatstream.github.io/mhn/) - makes deploying and managing secure honeypots extremely simple.
|
- [Modern Honeynet Network](http://threatstream.github.io/mhn/) - Streamlines deployment and management of secure honeypots.
|
||||||
|
|
||||||
- Honeypot extensions to Wireshark
|
- Honeypot extensions to Wireshark
|
||||||
- [Whireshark Extensions](https://www.honeynet.org/project/WiresharkExtensions) - support applying Snort IDS rules and signatures against pcap files.
|
- [Whireshark Extensions](https://www.honeynet.org/project/WiresharkExtensions) - Apply Snort IDS rules and signatures against packet capture files using Wireshark.
|
||||||
|
|
||||||
|
|
||||||
- Client
|
- Client
|
||||||
- [CWSandbox / GFI Sandbox](https://www.gfi.com/products-and-solutions/all-products)
|
- [CWSandbox / GFI Sandbox](https://www.gfi.com/products-and-solutions/all-products)
|
||||||
- [Capture-HPC-Linux](https://redmine.honeynet.org/projects/linux-capture-hpc/wiki)
|
- [Capture-HPC-Linux](https://redmine.honeynet.org/projects/linux-capture-hpc/wiki)
|
||||||
- [Capture-HPC-NG](https://github.com/CERT-Polska/HSN-Capture-HPC-NG)
|
- [Capture-HPC-NG](https://github.com/CERT-Polska/HSN-Capture-HPC-NG)
|
||||||
- [Capture-HPC](https://projects.honeynet.org/capture-hpc) - a high interaction client honeypot (also called honeyclient).
|
- [Capture-HPC](https://projects.honeynet.org/capture-hpc) - High interaction client honeypot (also called honeyclient).
|
||||||
- [HoneyBOT](http://www.atomicsoftwaresolutions.com/)
|
- [HoneyBOT](http://www.atomicsoftwaresolutions.com/)
|
||||||
- [HoneyC](https://projects.honeynet.org/honeyc)
|
- [HoneyC](https://projects.honeynet.org/honeyc)
|
||||||
- [HoneySpider Network](https://github.com/CERT-Polska/hsn2-bundle) - a highly-scalable system integrating multiple client honeypots to detect malicious websites.
|
- [HoneySpider Network](https://github.com/CERT-Polska/hsn2-bundle) - Highly-scalable system integrating multiple client honeypots to detect malicious websites.
|
||||||
- [HoneyWeb](https://code.google.com/archive/p/gsoc-honeyweb/) - Web interface created to manage and share remotly Honeyclients ressources.
|
- [HoneyWeb](https://code.google.com/archive/p/gsoc-honeyweb/) - Web interface created to manage and remotely share Honeyclients resources.
|
||||||
- [Jsunpack-n](https://github.com/urule99/jsunpack-n)
|
- [Jsunpack-n](https://github.com/urule99/jsunpack-n)
|
||||||
- [MonkeySpider](http://monkeyspider.sourceforge.net)
|
- [MonkeySpider](http://monkeyspider.sourceforge.net)
|
||||||
- [PhoneyC](https://github.com/honeynet/phoneyc) - Python honeyclient (later replaced by Thug)
|
- [PhoneyC](https://github.com/honeynet/phoneyc) - Python honeyclient (later replaced by Thug).
|
||||||
- [Pwnypot](https://github.com/shjalayeri/pwnypot) - High Interaction Client Honeypot
|
- [Pwnypot](https://github.com/shjalayeri/pwnypot) - High Interaction Client Honeypot.
|
||||||
- [Rumal](https://github.com/thugs-rumal/) - Thug's Rumāl: a Thug's dress & weapon.
|
- [Rumal](https://github.com/thugs-rumal/) - Thug's Rumāl: a Thug's dress and weapon.
|
||||||
- [Shelia](https://www.cs.vu.nl/~herbertb/misc/shelia/) - a client-side honeypot for attack detection
|
- [Shelia](https://www.cs.vu.nl/~herbertb/misc/shelia/) - Client-side honeypot for attack detection.
|
||||||
- [Thug](https://buffer.github.io/thug/) - Python low-interaction honeyclient
|
- [Thug](https://buffer.github.io/thug/) - Python-based low-interaction honeyclient.
|
||||||
- [Thug Distributed Task Queuing](https://thug-distributed.readthedocs.io/en/latest/index.html)
|
- [Thug Distributed Task Queuing](https://thug-distributed.readthedocs.io/en/latest/index.html)
|
||||||
- [Trigona](https://www.honeynet.org/project/Trigona)
|
- [Trigona](https://www.honeynet.org/project/Trigona)
|
||||||
- [URLQuery](https://urlquery.net/)
|
- [URLQuery](https://urlquery.net/)
|
||||||
- [YALIH (Yet Another Low Interaction Honeyclient)](https://github.com/Masood-M/yalih) - a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques
|
- [YALIH (Yet Another Low Interaction Honeyclient)](https://github.com/Masood-M/yalih) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques.
|
||||||
|
|
||||||
- Honeypot
|
- Honeypot
|
||||||
- [Deception Toolkit](http://www.all.net/dtk/dtk.html)
|
- [Deception Toolkit](http://www.all.net/dtk/dtk.html)
|
||||||
@ -255,40 +254,40 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
|
|||||||
- [Single-honeypot](https://sourceforge.net/projects/single-honeypot/)
|
- [Single-honeypot](https://sourceforge.net/projects/single-honeypot/)
|
||||||
|
|
||||||
- PDF document inspector
|
- PDF document inspector
|
||||||
- [peepdf](https://github.com/jesparza/peepdf) - Powerful Python tool to analyze PDF documents
|
- [peepdf](https://github.com/jesparza/peepdf) - Powerful Python tool to analyze PDF documents.
|
||||||
|
|
||||||
- Hybrid low/high interaction honeypot
|
- Hybrid low/high interaction honeypot
|
||||||
- [HoneyBrid](http://honeybrid.sourceforge.net)
|
- [HoneyBrid](http://honeybrid.sourceforge.net)
|
||||||
|
|
||||||
- SSH Honeypots
|
- SSH Honeypots
|
||||||
- [Blacknet](https://github.com/morian/blacknet) - Multi-head SSH honeypot system.
|
- [Blacknet](https://github.com/morian/blacknet) - Multi-head SSH honeypot system.
|
||||||
- [Cowrie](https://github.com/micheloosterhof/cowrie) - Cowrie SSH Honeypot (based on kippo)
|
- [Cowrie](https://github.com/micheloosterhof/cowrie) - Cowrie SSH Honeypot (based on kippo).
|
||||||
- [DShield docker](https://github.com/xme/dshield-docker) - Docker container running cowrie with DShield output enabled.
|
- [DShield docker](https://github.com/xme/dshield-docker) - Docker container running cowrie with DShield output enabled.
|
||||||
- [HonSSH](https://github.com/tnich/honssh) - HonSSH is designed to log all SSH communications between a client and server.
|
- [HonSSH](https://github.com/tnich/honssh) - Logs all SSH communications between a client and server.
|
||||||
- [HUDINX](https://github.com/Cryptix720/HUDINX) - tiny interaction SSH honeypot engineered in Python to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.
|
- [HUDINX](https://github.com/Cryptix720/HUDINX) - Tiny interaction SSH honeypot engineered in Python to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.
|
||||||
- [Kippo](https://github.com/desaster/kippo) - Medium interaction SSH honeypot
|
- [Kippo](https://github.com/desaster/kippo) - Medium interaction SSH honeypot.
|
||||||
- [Kippo_JunOS](https://github.com/gregcmartin/Kippo_JunOS) - Kippo configured to be a backdoored netscreen.
|
- [Kippo_JunOS](https://github.com/gregcmartin/Kippo_JunOS) - Kippo configured to be a backdoored netscreen.
|
||||||
- [Kojoney2](https://github.com/madirish/kojoney2) - low interaction SSH honeypot written in Python. Based on Kojoney by Jose Antonio Coret
|
- [Kojoney2](https://github.com/madirish/kojoney2) - Low interaction SSH honeypot written in Python and based on Kojoney by Jose Antonio Coret.
|
||||||
- [Kojoney](http://kojoney.sourceforge.net/) - Kojoney is a low level interaction honeypot that emulates an SSH server. The daemon is written in Python using the Twisted Conch libraries.
|
- [Kojoney](http://kojoney.sourceforge.net/) - Python-based Low interaction honeypot that emulates an SSH server implemented with Twisted Conch.
|
||||||
- [LongTail Log Analysis @ Marist College](http://longtail.it.marist.edu/honey/) - analyzed SSH honeypot logs
|
- [LongTail Log Analysis @ Marist College](http://longtail.it.marist.edu/honey/) - Analyzed SSH honeypot logs.
|
||||||
- [MockSSH](https://github.com/ncouture/MockSSH) - Mock an SSH server and define all commands it supports (Python, Twisted)
|
- [MockSSH](https://github.com/ncouture/MockSSH) - Mock an SSH server and define all commands it supports (Python, Twisted).
|
||||||
- [cowrie2neo](https://github.com/xlfe/cowrie2neo) - Parse cowrie honeypot logs into a neo4j database.
|
- [cowrie2neo](https://github.com/xlfe/cowrie2neo) - Parse cowrie honeypot logs into a neo4j database.
|
||||||
- [go-sshoney](https://github.com/ashmckenzie/go-sshoney) - SSH Honeypot
|
- [go-sshoney](https://github.com/ashmckenzie/go-sshoney) - SSH Honeypot.
|
||||||
- [go0r](https://github.com/fzerorubigd/go0r) - A simple ssh honeypot in golang
|
- [go0r](https://github.com/fzerorubigd/go0r) - Simple ssh honeypot in Golang.
|
||||||
- [gohoney](https://github.com/PaulMaddox/gohoney) - A SSH honeypot written in Go
|
- [gohoney](https://github.com/PaulMaddox/gohoney) - SSH honeypot written in Go.
|
||||||
- [hived](https://github.com/sahilm/hived) - a honeypot
|
- [hived](https://github.com/sahilm/hived) - Golang-based honeypot.
|
||||||
- [hnypots-agent)](https://github.com/joshrendek/hnypots-agent) - A SSH Server in Go that logs username/password combos
|
- [hnypots-agent)](https://github.com/joshrendek/hnypots-agent) - SSH Server in Go that logs username and password combinations.
|
||||||
- [honeypot.go](https://github.com/mdp/honeypot.go) - SSH Honeypot written in Go
|
- [honeypot.go](https://github.com/mdp/honeypot.go) - SSH Honeypot written in Go.
|
||||||
- [honeyssh](https://github.com/ppacher/honeyssh) - A credential dumping SSH honeypot with statistics
|
- [honeyssh](https://github.com/ppacher/honeyssh) - Credential dumping SSH honeypot with statistics.
|
||||||
- [hornet](https://github.com/czardoz/hornet) - Medium interaction SSH Honeypot that supports multiple virtual hosts
|
- [hornet](https://github.com/czardoz/hornet) - Medium interaction SSH honeypot that supports multiple virtual hosts.
|
||||||
- [ssh-auth-logger](https://github.com/JustinAzoff/ssh-auth-logger) - A low/zero interaction ssh authentication logging honeypot
|
- [ssh-auth-logger](https://github.com/JustinAzoff/ssh-auth-logger) - Low/zero interaction SSH authentication logging honeypot.
|
||||||
- [ssh-honeypot](https://github.com/droberson/ssh-honeypot) - Fake sshd that logs ip addresses, usernames, and passwords.
|
- [ssh-honeypot](https://github.com/droberson/ssh-honeypot) - Fake sshd that logs IP addresses, usernames, and passwords.
|
||||||
- [ssh-honeypotd](https://github.com/sjinks/ssh-honeypotd) - A low-interaction SSH honeypot written in C.
|
- [ssh-honeypotd](https://github.com/sjinks/ssh-honeypotd) - Low-interaction SSH honeypot written in C.
|
||||||
- [sshForShits](https://github.com/traetox/sshForShits) - framework for a high interaction SSH honeypot
|
- [sshForShits](https://github.com/traetox/sshForShits) - Framework for a high interaction SSH honeypot.
|
||||||
- [sshesame](https://github.com/jaksi/sshesame) - A fake SSH server that lets everyone in and logs their activity.
|
- [sshesame](https://github.com/jaksi/sshesame) - Fake SSH server that lets everyone in and logs their activity.
|
||||||
- [sshhipot](https://github.com/magisterquis/sshhipot) - High-interaction MitM SSH honeypot
|
- [sshhipot](https://github.com/magisterquis/sshhipot) - High-interaction MitM SSH honeypot.
|
||||||
- [sshlowpot](https://github.com/magisterquis/sshlowpot) - Yet another no-frills low-interaction ssh honeypot in Go.
|
- [sshlowpot](https://github.com/magisterquis/sshlowpot) - Yet another no-frills low-interaction SSH honeypot in Go.
|
||||||
- [sshsyrup](https://github.com/mkishere/sshsyrup) - A simple SSH Honeypot with features to capture terminal activity and upload to asciinema.org
|
- [sshsyrup](https://github.com/mkishere/sshsyrup) - Simple SSH Honeypot with features to capture terminal activity and upload to asciinema.org.
|
||||||
|
|
||||||
- Distributed sensor project
|
- Distributed sensor project
|
||||||
- [DShield Web Honeypot Project](https://sites.google.com/site/webhoneypotsite/)
|
- [DShield Web Honeypot Project](https://sites.google.com/site/webhoneypotsite/)
|
||||||
@ -303,13 +302,13 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
|
|||||||
- [HoneyDrive](https://bruteforcelab.com/honeydrive)
|
- [HoneyDrive](https://bruteforcelab.com/honeydrive)
|
||||||
|
|
||||||
- Honeypot sensor
|
- Honeypot sensor
|
||||||
- [Honeeepi] (https://redmine.honeynet.org/projects/honeeepi/wiki) - Honeeepi is a honeypot sensor on Raspberry Pi which based on customized Raspbian OS.
|
- [Honeeepi](https://redmine.honeynet.org/projects/honeeepi/wiki) - Honeypot sensor on a Raspberry Pi based on a customized Raspbian OS.
|
||||||
|
|
||||||
- File carving
|
- File carving
|
||||||
- [TestDisk & PhotoRec](https://www.cgsecurity.org/)
|
- [TestDisk & PhotoRec](https://www.cgsecurity.org/)
|
||||||
|
|
||||||
- Sebek
|
- Sebek
|
||||||
- [Qebek](https://projects.honeynet.org/sebek/wiki/Qebek) - QEMU based Sebek. As Sebek, it is data capture tool for high interaction honeypot.
|
- [Qebek](https://projects.honeynet.org/sebek/wiki/Qebek) - QEMU based Sebek, a data capture tool for high interaction honeypot.
|
||||||
- [Sebek](https://projects.honeynet.org/sebek/) - Data capture.
|
- [Sebek](https://projects.honeynet.org/sebek/) - Data capture.
|
||||||
- [xebek](https://code.google.com/archive/p/xebek/) - Sebek on Xen.
|
- [xebek](https://code.google.com/archive/p/xebek/) - Sebek on Xen.
|
||||||
|
|
||||||
@ -322,7 +321,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
|
|||||||
- Spamtrap
|
- Spamtrap
|
||||||
- [Mail::SMTP::Honeypot](https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - Perl module that appears to provide the functionality of a standard SMTP server.
|
- [Mail::SMTP::Honeypot](https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - Perl module that appears to provide the functionality of a standard SMTP server.
|
||||||
- [Mailoney](https://github.com/awhitehatter/mailoney) - SMTP honeypot, Open Relay, Cred Harvester written in python.
|
- [Mailoney](https://github.com/awhitehatter/mailoney) - SMTP honeypot, Open Relay, Cred Harvester written in python.
|
||||||
- [SendMeSpamIDS.py](https://github.com/johestephan/VerySimpleHoneypot) Simple SMTP fetch all IDS and analyzer.
|
- [SendMeSpamIDS.py](https://github.com/johestephan/VerySimpleHoneypot) - Simple SMTP fetch all IDS and analyzer.
|
||||||
- [Shiva](https://github.com/shiva-spampot/shiva) - Spam Honeypot with Intelligent Virtual Analyzer.
|
- [Shiva](https://github.com/shiva-spampot/shiva) - Spam Honeypot with Intelligent Virtual Analyzer.
|
||||||
- [Shiva The Spam Honeypot Tips And Tricks For Getting It Up And Running](https://www.pentestpartners.com/security-blog/shiva-the-spam-honeypot-tips-and-tricks-for-getting-it-up-and-running/)
|
- [Shiva The Spam Honeypot Tips And Tricks For Getting It Up And Running](https://www.pentestpartners.com/security-blog/shiva-the-spam-honeypot-tips-and-tricks-for-getting-it-up-and-running/)
|
||||||
- [SpamHAT](https://github.com/miguelraulb/spamhat) - Spam Honeypot Tool.
|
- [SpamHAT](https://github.com/miguelraulb/spamhat) - Spam Honeypot Tool.
|
||||||
@ -362,7 +361,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
|
|||||||
- [Honeyλ (HoneyLambda)](https://github.com/0x4D31/honeylambda) - Simple, serverless application designed to create and monitor URL honeytokens, on top of AWS Lambda and Amazon API Gateway.
|
- [Honeyλ (HoneyLambda)](https://github.com/0x4D31/honeylambda) - Simple, serverless application designed to create and monitor URL honeytokens, on top of AWS Lambda and Amazon API Gateway.
|
||||||
- [dcept](https://github.com/secureworks/dcept) - Tool for deploying and detecting use of Active Directory honeytokens.
|
- [dcept](https://github.com/secureworks/dcept) - Tool for deploying and detecting use of Active Directory honeytokens.
|
||||||
|
|
||||||
## <a name="honeyd"></a> Honeyd Tools
|
## Honeyd Tools
|
||||||
|
|
||||||
- Honeyd plugin
|
- Honeyd plugin
|
||||||
- [Honeycomb](http://www.honeyd.org/tools.php)
|
- [Honeycomb](http://www.honeyd.org/tools.php)
|
||||||
@ -385,7 +384,7 @@ the honeyd daemon and generate configuration files.
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
## <a name="analysis"></a> Network and Artifact Analysis
|
## Network and Artifact Analysis
|
||||||
|
|
||||||
- Sandbox
|
- Sandbox
|
||||||
- [Argos](http://www.few.vu.nl/argos/) - Emulator for capturing zero-day attacks.
|
- [Argos](http://www.few.vu.nl/argos/) - Emulator for capturing zero-day attacks.
|
||||||
@ -405,7 +404,7 @@ the honeyd daemon and generate configuration files.
|
|||||||
- [detux.org](https://detux.org) - Multiplatform Linux Sandbox.
|
- [detux.org](https://detux.org) - Multiplatform Linux Sandbox.
|
||||||
- [malwr.com](https://malwr.com/) - Free malware analysis service and community.
|
- [malwr.com](https://malwr.com/) - Free malware analysis service and community.
|
||||||
|
|
||||||
## <a name="visualizers"></a> Data Tools
|
## Data Tools
|
||||||
|
|
||||||
- Front Ends
|
- Front Ends
|
||||||
- [DionaeaFR](https://github.com/rubenespadas/DionaeaFR) - Front Web to Dionaea low-interaction honeypot.
|
- [DionaeaFR](https://github.com/rubenespadas/DionaeaFR) - Front Web to Dionaea low-interaction honeypot.
|
||||||
@ -431,7 +430,7 @@ the honeyd daemon and generate configuration files.
|
|||||||
- [The Intelligent HoneyNet](https://github.com/jpyorre/IntelligentHoneyNet) - Create actionable information from honeypots.
|
- [The Intelligent HoneyNet](https://github.com/jpyorre/IntelligentHoneyNet) - Create actionable information from honeypots.
|
||||||
- [ovizart](https://github.com/oguzy/ovizart) - Visual analysis for network traffic.
|
- [ovizart](https://github.com/oguzy/ovizart) - Visual analysis for network traffic.
|
||||||
|
|
||||||
## <a name="guides"></a>Guides
|
## Guides
|
||||||
|
|
||||||
- [T-Pot: A Multi-Honeypot Platform](https://dtag-dev-sec.github.io/mediator/feature/2015/03/17/concept.html)
|
- [T-Pot: A Multi-Honeypot Platform](https://dtag-dev-sec.github.io/mediator/feature/2015/03/17/concept.html)
|
||||||
- [Honeypot (Dionaea and kippo) setup script](https://github.com/andrewmichaelsmith/honeypot-setup-script/)
|
- [Honeypot (Dionaea and kippo) setup script](https://github.com/andrewmichaelsmith/honeypot-setup-script/)
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user