Merge pull request #93 from christophe77/master

looks like you added expresspot and did some whitespace changes, but the layout looks good. thanks, cool project too.

README.md

@@ -8,12 +8,14 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
 
 # Contents
 
-- [Related Lists](#related-lists)
+- [Awesome Honeypots ![Awesome Honeypots](https://github.com/sindresorhus/awesome)](#awesome-honeypots-)
-- [Honeypots](#honeypots)
+- [Contents](#contents)
-- [Honeyd Tools](#honeyd-tools)
+  - [Related Lists](#related-lists)
-- [Network and Artifact Analysis](#network-and-artifact-analysis)
+  - [Honeypots](#honeypots)
-- [Data Tools](#data-tools)
+  - [Honeyd Tools](#honeyd-tools)
-- [Guides](#guides)
+  - [Network and Artifact Analysis](#network-and-artifact-analysis)
+  - [Data Tools](#data-tools)
+  - [Guides](#guides)
 
 ## Related Lists
 
@@ -23,6 +25,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
 ## Honeypots
 
 - Database Honeypots
+
   - [Delilah](https://github.com/SecurityTW/delilah) - Elasticsearch Honeypot written in Python (originally from Novetta).
   - [ESPot](https://github.com/mycert/ESPot) - Elasticsearch honeypot written in NodeJS, to capture every attempts to exploit CVE-2014-3120.
   - [Elastic honey](https://github.com/jordan-wright/elastichoney) - Simple Elasticsearch Honeypot.
@@ -34,6 +37,8 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [sticky_elephant](https://github.com/betheroot/sticky_elephant) - Medium interaction postgresql honeypot.
 
 - Web honeypots
+
+  - [Express honeypot](https://github.com/christophe77/express-honeypot) - RFI & LFI honeypot using nodeJS and express.
   - [EoHoneypotBundle](https://github.com/eymengunay/EoHoneypotBundle) - Honeypot type for Symfony2 forms.
   - [Glastopf](https://github.com/mushorg/glastopf) - Web Application Honeypot.
   - [Google Hack Honeypot](http://ghh.sourceforge.net) - Designed to provide reconnaissance against attackers that use search engines as a hacking tool against your resources.
@@ -67,6 +72,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
     - [wordpot](https://github.com/gbrindisi/wordpot) - WordPress Honeypot.
 
 - Service Honeypots
+
   - [ADBHoney](https://github.com/huuck/ADBHoney) - Low interaction honeypot that simulates an Android device running Android Debug Bridge (ADB) server process.
   - [AMTHoneypot](https://github.com/packetflare/amthoneypot) - Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689.
   - [DolosHoneypot](https://github.com/Marist-Innovation-Lab/DolosHoneypot) - SDN (software defined networking) honeypot.
@@ -92,12 +98,15 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [troje](https://github.com/dutchcoders/troje/) - Honeypot that runs each connection with the service within a separate LXC container.
 
 - Distributed Honeypots
+
   - [DemonHunter](https://github.com/RevengeComing/DemonHunter) - Low interaction honeypot server.
 
 - Anti-honeypot stuff
+
   - [kippo_detect](https://github.com/andrew-morris/kippo_detect) - Offensive component that detects the presence of the kippo honeypot.
 
 - ICS/SCADA honeypots
+
   - [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA honeypot.
   - [GasPot](https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, common in the oil and gas industry.
   - [SCADA honeynet](http://scadahoneynet.sourceforge.net) - Building Honeypots for Industrial Networks.
@@ -105,6 +114,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [scada-honeynet](http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/) - Mimics many of the services from a popular PLC and better helps SCADA researchers understand potential risks of exposed control system devices.
 
 - Other/random
+
   - [Damn Simple Honeypot (DSHP)](https://github.com/naorlivne/dshp) - Honeypot framework with pluggable handlers.
   - [NOVA](https://github.com/DataSoft/Nova) - Uses honeypots as detectors, looks like a complete system.
   - [OpenFlow Honeypot (OFPot)](https://github.com/upa/ofpot) - Redirects traffic for unused IPs to a honeypot, built on POX.
@@ -113,76 +123,97 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [miniprint](https://github.com/sa7mon/miniprint) - A medium interaction printer honeypot.
 
 - Botnet C2 tools
+
   - [Hale](https://github.com/pjlantz/Hale) - Botnet command and control monitor.
   - [dnsMole](https://code.google.com/archive/p/dns-mole/) - Analyses DNS traffic and potentionaly detect botnet command and control server activity, along with infected hosts.
 
 - IPv6 attack detection tool
+
   - [ipv6-attack-detector](https://github.com/mzweilin/ipv6-attack-detector/) - Google Summer of Code 2012 project, supported by The Honeynet Project organization.
 
 - Dynamic code instrumentation toolkit
+
   - [Frida](https://www.frida.re) - Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android.
 
 - Tool to convert website to server honeypots
+
   - [HIHAT](http://hihat.sourceforge.net/) - Transform arbitrary PHP applications into web-based high-interaction Honeypots.
 
 - Malware collector
+
   - [Kippo-Malware](https://bruteforcelab.com/kippo-malware) - Python script that will download all malicious files stored as URLs in a Kippo SSH honeypot database.
 
 - Distributed sensor deployment
+
   - [Community Honey Network](https://communityhoneynetwork.readthedocs.io/en/stable/) - CHN aims to make deployments honeypots and honeypot management tools easy and flexible. The default deployment method uses Docker Compose and Docker to deploy with a few simple commands.
   - [Modern Honey Network](https://github.com/threatstream/mhn) - Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management.
 
 - Network Analysis Tool
+
   - [Tracexploit](https://code.google.com/archive/p/tracexploit/) - Replay network packets.
 
 - Log anonymizer
+
   - [LogAnon](http://code.google.com/archive/p/loganon/) - Log anonymization library that helps having anonymous logs consistent between logs and network captures.
 
 - Low interaction honeypot (router back door)
+
   - [Honeypot-32764](https://github.com/knalli/honeypot-for-tcp-32764) - Honeypot for router backdoor (TCP 32764).
   - [WAPot](https://github.com/lcashdol/WAPot) - Honeypot that can be used to observe traffic directed at home routers.
 
 - honeynet farm traffic redirector
+
   - [Honeymole](https://web.archive.org/web/20100326040550/http://www.honeynet.org.pt:80/index.php/HoneyMole) - Deploy multiple sensors that redirect traffic to a centralized collection of honeypots.
 
 - HTTPS Proxy
+
   - [mitmproxy](https://mitmproxy.org/) - Allows traffic flows to be intercepted, inspected, modified, and replayed.
 
 - System instrumentation
+
   - [Sysdig](https://sysdig.com/opensource/) - Open source, system-level exploration allows one to capture system state and activity from a running GNU/Linux instance, then save, filter, and analyze the results.
   - [Fibratus](https://github.com/rabbitstack/fibratus) - Tool for exploration and tracing of the Windows kernel.
 
 - Honeypot for USB-spreading malware
+
   - [Ghost-usb](https://github.com/honeynet/ghost-usb-honeypot) - Honeypot for malware that propagates via USB storage devices.
 
 - Data Collection
+
   - [Kippo2MySQL](https://bruteforcelab.com/kippo2mysql) - Extracts some very basic stats from Kippo’s text-based log files and inserts them in a MySQL database.
   - [Kippo2ElasticSearch](https://bruteforcelab.com/kippo2elasticsearch) - Python script to transfer data from a Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster).
 
 - Passive network audit framework parser
+
   - [Passive Network Audit Framework (pnaf)](https://github.com/jusafing/pnaf) - Framework that combines multiple passive and automated analysis techniques in order to provide a security assessment of network platforms.
 
 - VM monitoring and tools
+
   - [Antivmdetect](https://github.com/nsmfoo/antivmdetection) - Script to create templates to use with VirtualBox to make VM detection harder.
   - [VMCloak](https://github.com/hatching/vmcloak) - Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
   - [vmitools](http://libvmi.com/) - C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine.
 
 - Binary debugger
+
   - [Hexgolems - Pint Debugger Backend](https://github.com/hexgolems/pint) - Debugger backend and LUA wrapper for PIN.
   - [Hexgolems - Schem Debugger Frontend](https://github.com/hexgolems/schem) - Debugger frontend.
 
 - Mobile Analysis Tool
+
   - [Androguard](https://github.com/androguard/androguard) - Reverse engineering, Malware and goodware analysis of Android applications and more.
   - [APKinspector](https://github.com/honeynet/apkinspector/) - Powerful GUI tool for analysts to analyze the Android applications.
 
 - Low interaction honeypot
+
   - [Honeyperl](https://sourceforge.net/projects/honeyperl/) - Honeypot software based in Perl with plugins developed for many functions like : wingates, telnet, squid, smtp, etc.
   - [T-Pot](https://github.com/dtag-dev-sec/tpotce) - All in one honeypot appliance from telecom provider T-Mobile
 
 - Honeynet data fusion
+
   - [HFlow2](https://projects.honeynet.org/hflow) - Data coalesing tool for honeynet/network analysis.
 
 - Server
+
   - [Amun](http://amunhoney.sourceforge.net) - Vulnerability emulation honeypot.
   - [Artillery](https://github.com/trustedsec/artillery/) - Open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
   - [Bait and Switch](http://baitnswitch.sourceforge.net) - Redirects all hostile traffic to a honeypot that is partially mirroring your production system.
@@ -216,32 +247,38 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [telnetlogger](https://github.com/robertdavidgraham/telnetlogger) - Telnet honeypot designed to track the Mirai botnet.
   - [vnclowpot](https://github.com/magisterquis/vnclowpot) - Low interaction VNC honeypot.
 
-
 - IDS signature generation
+
   - [Honeycomb](http://www.icir.org/christian/honeycomb/) - Automated signature creation using honeypots.
 
 - Lookup service for AS-numbers and prefixes
+
   - [CC2ASN](http://www.cc2asn.com/) - Simple lookup service for AS-numbers and prefixes belonging to any given country in the world.
 
 - Data Collection / Data Sharing
+
   - [HPfriends](http://hpfriends.honeycloud.net/#/home) - Honeypot data-sharing platform.
     - [hpfriends - real-time social data-sharing](https://heipei.io/sigint-hpfriends/) - Presentation about HPFriends feed system
   - [HPFeeds](https://github.com/rep/hpfeeds/) - Lightweight authenticated publish-subscribe protocol.
 
 - Central management tool
+
   - [PHARM](http://www.nepenthespharm.com/) - Manage, report, and analyze your distributed Nepenthes instances.
 
 - Network connection analyzer
+
   - [Impost](http://impost.sourceforge.net/) - Network security auditing tool designed to analyze the forensics behind compromised and/or vulnerable daemons.
 
 - Honeypot deployment
+
   - [Modern Honeynet Network](http://threatstream.github.io/mhn/) - Streamlines deployment and management of secure honeypots.
 
 - Honeypot extensions to Wireshark
+
   - [Wireshark Extensions](https://www.honeynet.org/project/WiresharkExtensions) - Apply Snort IDS rules and signatures against packet capture files using Wireshark.
 
-
 - Client
+
   - [CWSandbox / GFI Sandbox](https://www.gfi.com/products-and-solutions/all-products)
   - [Capture-HPC-Linux](https://redmine.honeynet.org/projects/linux-capture-hpc/wiki)
   - [Capture-HPC-NG](https://github.com/CERT-Polska/HSN-Capture-HPC-NG)
@@ -263,16 +300,20 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [YALIH (Yet Another Low Interaction Honeyclient)](https://github.com/Masood-M/yalih) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques.
 
 - Honeypot
+
   - [Deception Toolkit](http://www.all.net/dtk/dtk.html)
   - [IMHoneypot](https://github.com/mushorg/imhoneypot)
 
 - PDF document inspector
+
   - [peepdf](https://github.com/jesparza/peepdf) - Powerful Python tool to analyze PDF documents.
 
 - Hybrid low/high interaction honeypot
+
   - [HoneyBrid](http://honeybrid.sourceforge.net)
 
 - SSH Honeypots
+
   - [Blacknet](https://github.com/morian/blacknet) - Multi-head SSH honeypot system.
   - [Cowrie](https://github.com/cowrie/cowrie) - Cowrie SSH Honeypot (based on kippo).
   - [DShield docker](https://github.com/xme/dshield-docker) - Docker container running cowrie with DShield output enabled.
@@ -307,30 +348,39 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [twisted-honeypots](https://github.com/lanjelot/twisted-honeypots) - SSH, FTP and Telnet honeypots based on Twisted.
 
 - Distributed sensor project
+
   - [DShield Web Honeypot Project](https://sites.google.com/site/webhoneypotsite/)
 
 - A pcap analyzer
+
   - [Honeysnap](https://projects.honeynet.org/honeysnap/)
 
 - Network traffic redirector
+
   - [Honeywall](https://projects.honeynet.org/honeywall/)
 
 - Honeypot Distribution with mixed content
+
   - [HoneyDrive](https://bruteforcelab.com/honeydrive)
 
 - Honeypot sensor
+
   - [Honeeepi](https://redmine.honeynet.org/projects/honeeepi/wiki) - Honeypot sensor on a Raspberry Pi based on a customized Raspbian OS.
 
 - File carving
+
   - [TestDisk & PhotoRec](https://www.cgsecurity.org/)
 
 - Behavioral analysis tool for win32
+
   - [Capture BAT](https://www.honeynet.org/node/315)
 
 - Live CD
+
   - [DAVIX](https://www.secviz.org/node/89) - The DAVIX Live CD.
 
 - Spamtrap
+
   - [Mail::SMTP::Honeypot](https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - Perl module that appears to provide the functionality of a standard SMTP server.
   - [Mailoney](https://github.com/awhitehatter/mailoney) - SMTP honeypot, Open Relay, Cred Harvester written in python.
   - [SendMeSpamIDS.py](https://github.com/johestephan/VerySimpleHoneypot) - Simple SMTP fetch all IDS and analyzer.
@@ -342,15 +392,19 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [spamd](http://man.openbsd.org/cgi-bin/man.cgi?query=spamd%26apropos=0%26sektion=0%26manpath=OpenBSD+Current%26arch=i386%26format=html)
 
 - Commercial honeynet
+
   - [Cymmetria Mazerunner](ttps://cymmetria.com/products/mazerunner/) - Leads attackers away from real targets and creates a footprint of the attack.
 
 - Server (Bluetooth)
+
   - [Bluepot](https://github.com/andrewmichaelsmith/bluepot)
 
 - Dynamic analysis of Android apps
+
   - [Droidbox](https://code.google.com/archive/p/droidbox/)
 
 - Dockerized Low Interaction packaging
+
   - [Docker honeynet](https://github.com/sreinhardt/Docker-Honeynet) - Several Honeynet tools set up for Docker containers.
   - [Dockerized Thug](https://hub.docker.com/r/honeynet/thug/) - Dockerized [Thug](https://github.com/buffer/thug) to analyze malicious web content.
   - [Dockerpot](https://github.com/mrschyte/dockerpot) - Docker based honeypot.
@@ -359,12 +413,15 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [mhn-core-docker](https://github.com/MattCarothers/mhn-core-docker) - Core elements of the Modern Honey Network implemented in Docker.
 
 - Network analysis
+
   - [Quechua](https://bitbucket.org/zaccone/quechua)
 
 - SIP Server
+
   - [Artemnesia VoIP](http://artemisa.sourceforge.net)
 
 - IOT Honeypot
+
   - [HoneyThing](https://github.com/omererdem/honeything) - TR-069 Honeypot.
   - [Kako](https://github.com/darkarnium/kako) - Honeypots for a number of well known and deployed embedded device vulnerabilities.
 
@@ -378,25 +435,28 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
 ## Honeyd Tools
 
 - Honeyd plugin
+
   - [Honeycomb](http://www.honeyd.org/tools.php)
 
 - Honeyd viewer
+
   - [Honeyview](http://honeyview.sourceforge.net/)
 
 - Honeyd to MySQL connector
+
   - [Honeyd2MySQL](https://bruteforcelab.com/honeyd2mysql)
 
 - A script to visualize statistics from honeyd
+
   - [Honeyd-Viz](https://bruteforcelab.com/honeyd-viz)
 
 - Honeyd stats
   - [Honeydsum.pl](https://github.com/DataSoft/Honeyd/blob/master/scripts/misc/honeydsum-v0.3/honeydsum.pl)
 
-
-
 ## Network and Artifact Analysis
 
 - Sandbox
+
   - [Argos](http://www.few.vu.nl/argos/) - Emulator for capturing zero-day attacks.
   - [COMODO automated sandbox](https://help.comodo.com/topic-72-1-451-4768-.html)
   - [Cuckoo](https://cuckoosandbox.org/) - Leading open source automated malware analysis system.
@@ -406,7 +466,6 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
   - [imalse](https://github.com/hbhzwj/imalse) - Integrated MALware Simulator and Emulator.
   - [libemu](https://github.com/buffer/libemu) - Shellcode emulation library, useful for shellcode detection.
 
-
 - Sandbox-as-a-Service
   - [Hybrid Analysis](https://www.hybrid-analysis.com) - Free malware analysis service powered by Payload Security that detects and analyzes unknown threats using a unique Hybrid Analysis technology.
   - [Joebox Cloud](https://jbxcloud.joesecurity.org/login) - Analyzes the behavior of malicious files including PEs, PDFs, DOCs, PPTs, XLSs, APKs, URLs and MachOs on Windows, Android and Mac OS X for suspicious activities.
@@ -416,6 +475,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
 ## Data Tools
 
 - Front Ends
+
   - [DionaeaFR](https://github.com/rubenespadas/DionaeaFR) - Front Web to Dionaea low-interaction honeypot.
   - [Django-kippo](https://github.com/jedie/django-kippo) - Django App for kippo SSH Honeypot.
   - [Shockpot-Frontend](https://github.com/GovCERT-CZ/Shockpot-Frontend) - Full featured script to visualize statistics from a Shockpot honeypot.
@@ -444,6 +504,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
 - [Honeypot (Dionaea and kippo) setup script](https://github.com/andrewmichaelsmith/honeypot-setup-script/)
 
 - Deployment
+
   - [Dionaea and EC2 in 20 Minutes](http://andrewmichaelsmith.com/2012/03/dionaea-honeypot-on-ec2-in-20-minutes/) - Tutorial on setting up Dionaea on an EC2 instance.
   - [Using a Raspberry Pi honeypot to contribute data to DShield/ISC](https://isc.sans.edu/diary/22680) - The Raspberry Pi based system will allow us to maintain one code base that will make it easier to collect rich logs beyond firewall logs.
   - [honeypotpi](https://github.com/free5ty1e/honeypotpi) - Script for turning a Raspberry Pi into a HoneyPot Pi.