Merge pull request #93 from christophe77/master

looks like you added expresspot and did some whitespace changes, but the layout looks good. thanks, cool project too.
2024-10-01 06:35:45 -04:00 · 2022-01-11 13:24:56 -05:00 · 2022-01-11 13:24:56 -05:00 · 44ffa68800
commit 44ffa68800
parent 522c2c6d66 c9e5661e45
1 changed files with 348 additions and 287 deletions
--- a/README.md
+++ b/README.md
@ -8,12 +8,14 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres

 # Contents

- [Related Lists](#related-lists)
- [Honeypots](#honeypots)
- [Honeyd Tools](#honeyd-tools)
- [Network and Artifact Analysis](#network-and-artifact-analysis)
- [Data Tools](#data-tools)
- [Guides](#guides)
+- [Awesome Honeypots ![Awesome Honeypots](https://github.com/sindresorhus/awesome)](#awesome-honeypots-)
+- [Contents](#contents)
+  - [Related Lists](#related-lists)
+  - [Honeypots](#honeypots)
+  - [Honeyd Tools](#honeyd-tools)
+  - [Network and Artifact Analysis](#network-and-artifact-analysis)
+  - [Data Tools](#data-tools)
+  - [Guides](#guides)

 ## Related Lists

@ -23,6 +25,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
 ## Honeypots

 - Database Honeypots
+
  - [Delilah](https://github.com/SecurityTW/delilah) - Elasticsearch Honeypot written in Python (originally from Novetta).
  - [ESPot](https://github.com/mycert/ESPot) - Elasticsearch honeypot written in NodeJS, to capture every attempts to exploit CVE-2014-3120.
  - [Elastic honey](https://github.com/jordan-wright/elastichoney) - Simple Elasticsearch Honeypot.
@ -34,6 +37,8 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [sticky_elephant](https://github.com/betheroot/sticky_elephant) - Medium interaction postgresql honeypot.

 - Web honeypots
+
+  - [Express honeypot](https://github.com/christophe77/express-honeypot) - RFI & LFI honeypot using nodeJS and express.
  - [EoHoneypotBundle](https://github.com/eymengunay/EoHoneypotBundle) - Honeypot type for Symfony2 forms.
  - [Glastopf](https://github.com/mushorg/glastopf) - Web Application Honeypot.
  - [Google Hack Honeypot](http://ghh.sourceforge.net) - Designed to provide reconnaissance against attackers that use search engines as a hacking tool against your resources.
@ -67,6 +72,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
    - [wordpot](https://github.com/gbrindisi/wordpot) - WordPress Honeypot.

 - Service Honeypots
+
  - [ADBHoney](https://github.com/huuck/ADBHoney) - Low interaction honeypot that simulates an Android device running Android Debug Bridge (ADB) server process.
  - [AMTHoneypot](https://github.com/packetflare/amthoneypot) - Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689.
  - [DolosHoneypot](https://github.com/Marist-Innovation-Lab/DolosHoneypot) - SDN (software defined networking) honeypot.
@ -92,12 +98,15 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [troje](https://github.com/dutchcoders/troje/) - Honeypot that runs each connection with the service within a separate LXC container.

 - Distributed Honeypots
+
  - [DemonHunter](https://github.com/RevengeComing/DemonHunter) - Low interaction honeypot server.

 - Anti-honeypot stuff
+
  - [kippo_detect](https://github.com/andrew-morris/kippo_detect) - Offensive component that detects the presence of the kippo honeypot.

 - ICS/SCADA honeypots
+
  - [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA honeypot.
  - [GasPot](https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, common in the oil and gas industry.
  - [SCADA honeynet](http://scadahoneynet.sourceforge.net) - Building Honeypots for Industrial Networks.
@ -105,6 +114,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [scada-honeynet](http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/) - Mimics many of the services from a popular PLC and better helps SCADA researchers understand potential risks of exposed control system devices.

 - Other/random
+
  - [Damn Simple Honeypot (DSHP)](https://github.com/naorlivne/dshp) - Honeypot framework with pluggable handlers.
  - [NOVA](https://github.com/DataSoft/Nova) - Uses honeypots as detectors, looks like a complete system.
  - [OpenFlow Honeypot (OFPot)](https://github.com/upa/ofpot) - Redirects traffic for unused IPs to a honeypot, built on POX.
@ -113,76 +123,97 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [miniprint](https://github.com/sa7mon/miniprint) - A medium interaction printer honeypot.

 - Botnet C2 tools
+
  - [Hale](https://github.com/pjlantz/Hale) - Botnet command and control monitor.
  - [dnsMole](https://code.google.com/archive/p/dns-mole/) - Analyses DNS traffic and potentionaly detect botnet command and control server activity, along with infected hosts.

 - IPv6 attack detection tool
+
  - [ipv6-attack-detector](https://github.com/mzweilin/ipv6-attack-detector/) - Google Summer of Code 2012 project, supported by The Honeynet Project organization.

 - Dynamic code instrumentation toolkit
+
  - [Frida](https://www.frida.re) - Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android.

 - Tool to convert website to server honeypots
+
  - [HIHAT](http://hihat.sourceforge.net/) - Transform arbitrary PHP applications into web-based high-interaction Honeypots.

 - Malware collector
+
  - [Kippo-Malware](https://bruteforcelab.com/kippo-malware) - Python script that will download all malicious files stored as URLs in a Kippo SSH honeypot database.

 - Distributed sensor deployment
+
  - [Community Honey Network](https://communityhoneynetwork.readthedocs.io/en/stable/) - CHN aims to make deployments honeypots and honeypot management tools easy and flexible. The default deployment method uses Docker Compose and Docker to deploy with a few simple commands.
  - [Modern Honey Network](https://github.com/threatstream/mhn) - Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management.

 - Network Analysis Tool
+
  - [Tracexploit](https://code.google.com/archive/p/tracexploit/) - Replay network packets.

 - Log anonymizer
+
  - [LogAnon](http://code.google.com/archive/p/loganon/) - Log anonymization library that helps having anonymous logs consistent between logs and network captures.

 - Low interaction honeypot (router back door)
+
  - [Honeypot-32764](https://github.com/knalli/honeypot-for-tcp-32764) - Honeypot for router backdoor (TCP 32764).
  - [WAPot](https://github.com/lcashdol/WAPot) - Honeypot that can be used to observe traffic directed at home routers.

 - honeynet farm traffic redirector
+
  - [Honeymole](https://web.archive.org/web/20100326040550/http://www.honeynet.org.pt:80/index.php/HoneyMole) - Deploy multiple sensors that redirect traffic to a centralized collection of honeypots.

 - HTTPS Proxy
+
  - [mitmproxy](https://mitmproxy.org/) - Allows traffic flows to be intercepted, inspected, modified, and replayed.

 - System instrumentation
+
  - [Sysdig](https://sysdig.com/opensource/) - Open source, system-level exploration allows one to capture system state and activity from a running GNU/Linux instance, then save, filter, and analyze the results.
  - [Fibratus](https://github.com/rabbitstack/fibratus) - Tool for exploration and tracing of the Windows kernel.

 - Honeypot for USB-spreading malware
+
  - [Ghost-usb](https://github.com/honeynet/ghost-usb-honeypot) - Honeypot for malware that propagates via USB storage devices.

 - Data Collection
+
  - [Kippo2MySQL](https://bruteforcelab.com/kippo2mysql) - Extracts some very basic stats from Kippo’s text-based log files and inserts them in a MySQL database.
  - [Kippo2ElasticSearch](https://bruteforcelab.com/kippo2elasticsearch) - Python script to transfer data from a Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster).

 - Passive network audit framework parser
+
  - [Passive Network Audit Framework (pnaf)](https://github.com/jusafing/pnaf) - Framework that combines multiple passive and automated analysis techniques in order to provide a security assessment of network platforms.

 - VM monitoring and tools
+
  - [Antivmdetect](https://github.com/nsmfoo/antivmdetection) - Script to create templates to use with VirtualBox to make VM detection harder.
  - [VMCloak](https://github.com/hatching/vmcloak) - Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
  - [vmitools](http://libvmi.com/) - C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine.

 - Binary debugger
+
  - [Hexgolems - Pint Debugger Backend](https://github.com/hexgolems/pint) - Debugger backend and LUA wrapper for PIN.
  - [Hexgolems - Schem Debugger Frontend](https://github.com/hexgolems/schem) - Debugger frontend.

 - Mobile Analysis Tool
+
  - [Androguard](https://github.com/androguard/androguard) - Reverse engineering, Malware and goodware analysis of Android applications and more.
  - [APKinspector](https://github.com/honeynet/apkinspector/) - Powerful GUI tool for analysts to analyze the Android applications.

 - Low interaction honeypot
+
  - [Honeyperl](https://sourceforge.net/projects/honeyperl/) - Honeypot software based in Perl with plugins developed for many functions like : wingates, telnet, squid, smtp, etc.
  - [T-Pot](https://github.com/dtag-dev-sec/tpotce) - All in one honeypot appliance from telecom provider T-Mobile

 - Honeynet data fusion
+
  - [HFlow2](https://projects.honeynet.org/hflow) - Data coalesing tool for honeynet/network analysis.

 - Server
+
  - [Amun](http://amunhoney.sourceforge.net) - Vulnerability emulation honeypot.
  - [Artillery](https://github.com/trustedsec/artillery/) - Open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
  - [Bait and Switch](http://baitnswitch.sourceforge.net) - Redirects all hostile traffic to a honeypot that is partially mirroring your production system.
@ -216,32 +247,38 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [telnetlogger](https://github.com/robertdavidgraham/telnetlogger) - Telnet honeypot designed to track the Mirai botnet.
  - [vnclowpot](https://github.com/magisterquis/vnclowpot) - Low interaction VNC honeypot.

-
 - IDS signature generation
+
  - [Honeycomb](http://www.icir.org/christian/honeycomb/) - Automated signature creation using honeypots.

 - Lookup service for AS-numbers and prefixes
+
  - [CC2ASN](http://www.cc2asn.com/) - Simple lookup service for AS-numbers and prefixes belonging to any given country in the world.

 - Data Collection / Data Sharing
+
  - [HPfriends](http://hpfriends.honeycloud.net/#/home) - Honeypot data-sharing platform.
    - [hpfriends - real-time social data-sharing](https://heipei.io/sigint-hpfriends/) - Presentation about HPFriends feed system
  - [HPFeeds](https://github.com/rep/hpfeeds/) - Lightweight authenticated publish-subscribe protocol.

 - Central management tool
+
  - [PHARM](http://www.nepenthespharm.com/) - Manage, report, and analyze your distributed Nepenthes instances.

 - Network connection analyzer
+
  - [Impost](http://impost.sourceforge.net/) - Network security auditing tool designed to analyze the forensics behind compromised and/or vulnerable daemons.

 - Honeypot deployment
+
  - [Modern Honeynet Network](http://threatstream.github.io/mhn/) - Streamlines deployment and management of secure honeypots.

 - Honeypot extensions to Wireshark
+
  - [Wireshark Extensions](https://www.honeynet.org/project/WiresharkExtensions) - Apply Snort IDS rules and signatures against packet capture files using Wireshark.

-
 - Client
+
  - [CWSandbox / GFI Sandbox](https://www.gfi.com/products-and-solutions/all-products)
  - [Capture-HPC-Linux](https://redmine.honeynet.org/projects/linux-capture-hpc/wiki)
  - [Capture-HPC-NG](https://github.com/CERT-Polska/HSN-Capture-HPC-NG)
@ -263,16 +300,20 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [YALIH (Yet Another Low Interaction Honeyclient)](https://github.com/Masood-M/yalih) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques.

 - Honeypot
+
  - [Deception Toolkit](http://www.all.net/dtk/dtk.html)
  - [IMHoneypot](https://github.com/mushorg/imhoneypot)

 - PDF document inspector
+
  - [peepdf](https://github.com/jesparza/peepdf) - Powerful Python tool to analyze PDF documents.

 - Hybrid low/high interaction honeypot
+
  - [HoneyBrid](http://honeybrid.sourceforge.net)

 - SSH Honeypots
+
  - [Blacknet](https://github.com/morian/blacknet) - Multi-head SSH honeypot system.
  - [Cowrie](https://github.com/cowrie/cowrie) - Cowrie SSH Honeypot (based on kippo).
  - [DShield docker](https://github.com/xme/dshield-docker) - Docker container running cowrie with DShield output enabled.
@ -307,30 +348,39 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [twisted-honeypots](https://github.com/lanjelot/twisted-honeypots) - SSH, FTP and Telnet honeypots based on Twisted.

 - Distributed sensor project
+
  - [DShield Web Honeypot Project](https://sites.google.com/site/webhoneypotsite/)

 - A pcap analyzer
+
  - [Honeysnap](https://projects.honeynet.org/honeysnap/)

 - Network traffic redirector
+
  - [Honeywall](https://projects.honeynet.org/honeywall/)

 - Honeypot Distribution with mixed content
+
  - [HoneyDrive](https://bruteforcelab.com/honeydrive)

 - Honeypot sensor
+
  - [Honeeepi](https://redmine.honeynet.org/projects/honeeepi/wiki) - Honeypot sensor on a Raspberry Pi based on a customized Raspbian OS.

 - File carving
+
  - [TestDisk & PhotoRec](https://www.cgsecurity.org/)

 - Behavioral analysis tool for win32
+
  - [Capture BAT](https://www.honeynet.org/node/315)

 - Live CD
+
  - [DAVIX](https://www.secviz.org/node/89) - The DAVIX Live CD.

 - Spamtrap
+
  - [Mail::SMTP::Honeypot](https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - Perl module that appears to provide the functionality of a standard SMTP server.
  - [Mailoney](https://github.com/awhitehatter/mailoney) - SMTP honeypot, Open Relay, Cred Harvester written in python.
  - [SendMeSpamIDS.py](https://github.com/johestephan/VerySimpleHoneypot) - Simple SMTP fetch all IDS and analyzer.
@ -342,15 +392,19 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [spamd](http://man.openbsd.org/cgi-bin/man.cgi?query=spamd%26apropos=0%26sektion=0%26manpath=OpenBSD+Current%26arch=i386%26format=html)

 - Commercial honeynet
+
  - [Cymmetria Mazerunner](ttps://cymmetria.com/products/mazerunner/) - Leads attackers away from real targets and creates a footprint of the attack.

 - Server (Bluetooth)
+
  - [Bluepot](https://github.com/andrewmichaelsmith/bluepot)

 - Dynamic analysis of Android apps
+
  - [Droidbox](https://code.google.com/archive/p/droidbox/)

 - Dockerized Low Interaction packaging
+
  - [Docker honeynet](https://github.com/sreinhardt/Docker-Honeynet) - Several Honeynet tools set up for Docker containers.
  - [Dockerized Thug](https://hub.docker.com/r/honeynet/thug/) - Dockerized [Thug](https://github.com/buffer/thug) to analyze malicious web content.
  - [Dockerpot](https://github.com/mrschyte/dockerpot) - Docker based honeypot.
@ -359,12 +413,15 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [mhn-core-docker](https://github.com/MattCarothers/mhn-core-docker) - Core elements of the Modern Honey Network implemented in Docker.

 - Network analysis
+
  - [Quechua](https://bitbucket.org/zaccone/quechua)

 - SIP Server
+
  - [Artemnesia VoIP](http://artemisa.sourceforge.net)

 - IOT Honeypot
+
  - [HoneyThing](https://github.com/omererdem/honeything) - TR-069 Honeypot.
  - [Kako](https://github.com/darkarnium/kako) - Honeypots for a number of well known and deployed embedded device vulnerabilities.

@ -378,25 +435,28 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
 ## Honeyd Tools

 - Honeyd plugin
+
  - [Honeycomb](http://www.honeyd.org/tools.php)

 - Honeyd viewer
+
  - [Honeyview](http://honeyview.sourceforge.net/)

 - Honeyd to MySQL connector
+
  - [Honeyd2MySQL](https://bruteforcelab.com/honeyd2mysql)

 - A script to visualize statistics from honeyd
+
  - [Honeyd-Viz](https://bruteforcelab.com/honeyd-viz)

 - Honeyd stats
  - [Honeydsum.pl](https://github.com/DataSoft/Honeyd/blob/master/scripts/misc/honeydsum-v0.3/honeydsum.pl)

-
-
 ## Network and Artifact Analysis

 - Sandbox
+
  - [Argos](http://www.few.vu.nl/argos/) - Emulator for capturing zero-day attacks.
  - [COMODO automated sandbox](https://help.comodo.com/topic-72-1-451-4768-.html)
  - [Cuckoo](https://cuckoosandbox.org/) - Leading open source automated malware analysis system.
@ -406,7 +466,6 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
  - [imalse](https://github.com/hbhzwj/imalse) - Integrated MALware Simulator and Emulator.
  - [libemu](https://github.com/buffer/libemu) - Shellcode emulation library, useful for shellcode detection.

-
 - Sandbox-as-a-Service
  - [Hybrid Analysis](https://www.hybrid-analysis.com) - Free malware analysis service powered by Payload Security that detects and analyzes unknown threats using a unique Hybrid Analysis technology.
  - [Joebox Cloud](https://jbxcloud.joesecurity.org/login) - Analyzes the behavior of malicious files including PEs, PDFs, DOCs, PPTs, XLSs, APKs, URLs and MachOs on Windows, Android and Mac OS X for suspicious activities.
@ -416,6 +475,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
 ## Data Tools

 - Front Ends
+
  - [DionaeaFR](https://github.com/rubenespadas/DionaeaFR) - Front Web to Dionaea low-interaction honeypot.
  - [Django-kippo](https://github.com/jedie/django-kippo) - Django App for kippo SSH Honeypot.
  - [Shockpot-Frontend](https://github.com/GovCERT-CZ/Shockpot-Frontend) - Full featured script to visualize statistics from a Shockpot honeypot.
@ -444,6 +504,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
 - [Honeypot (Dionaea and kippo) setup script](https://github.com/andrewmichaelsmith/honeypot-setup-script/)

 - Deployment
+
  - [Dionaea and EC2 in 20 Minutes](http://andrewmichaelsmith.com/2012/03/dionaea-honeypot-on-ec2-in-20-minutes/) - Tutorial on setting up Dionaea on an EC2 instance.
  - [Using a Raspberry Pi honeypot to contribute data to DShield/ISC](https://isc.sans.edu/diary/22680) - The Raspberry Pi based system will allow us to maintain one code base that will make it easier to collect rich logs beyond firewall logs.
  - [honeypotpi](https://github.com/free5ty1e/honeypotpi) - Script for turning a Raspberry Pi into a HoneyPot Pi.