diff --git a/README.md b/README.md index b857434..be1cf9f 100644 --- a/README.md +++ b/README.md @@ -28,6 +28,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres - [Delilah](https://github.com/SecurityTW/delilah) - Elasticsearch Honeypot written in Python (originally from Novetta). - [ESPot](https://github.com/mycert/ESPot) - Elasticsearch honeypot written in NodeJS, to capture every attempts to exploit CVE-2014-3120. + - [ElasticPot](https://gitlab.com/bontchev/elasticpot) - An Elasticsearch Honeypot. - [Elastic honey](https://github.com/jordan-wright/elastichoney) - Simple Elasticsearch Honeypot. - [MongoDB-HoneyProxy](https://github.com/Plazmaz/MongoDB-HoneyProxy) - MongoDB honeypot proxy. - [NoSQLpot](https://github.com/torque59/nosqlpot) - Honeypot framework built on a NoSQL-style database. @@ -35,6 +36,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres - [MysqlPot](https://github.com/schmalle/MysqlPot) - MySQL honeypot, still very early stage. - [pghoney](https://github.com/betheroot/pghoney) - Low-interaction Postgres Honeypot. - [sticky_elephant](https://github.com/betheroot/sticky_elephant) - Medium interaction postgresql honeypot. + - [RedisHoneyPot](https://github.com/cypwnpwnsocute/RedisHoneyPot) - High Interaction Honeypot Solution for Redis protocol. - Web honeypots @@ -88,11 +90,14 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres - [Tom's Honeypot](https://github.com/inguardians/toms_honeypot) - Low interaction Python honeypot. - [WebLogic honeypot](https://github.com/Cymmetria/weblogic_honeypot) - Low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware. - [WhiteFace Honeypot](https://github.com/csirtgadgets/csirtg-honeypot) - Twisted based honeypot for WhiteFace. + - [ddospot](https://github.com/aelth/ddospot) - NTP, DNS, SSDP, Chargen and generic UDP-based amplification DDoS honeypot. + - [dionaea](https://github.com/DinoTools/dionaea) - Home of the dionaea honeypot. - [dhp](https://github.com/ciscocsirt/dhp) - Simple Docker Honeypot server emulating small snippets of the Docker HTTP API. - [honeycomb_plugins](https://github.com/Cymmetria/honeycomb_plugins) - Plugin repository for Honeycomb, the honeypot framework by Cymmetria. - [honeyntp](https://github.com/fygrave/honeyntp) - NTP logger/honeypot. - [honeypot-camera](https://github.com/alexbredo/honeypot-camera) - Observation camera honeypot. - [honeypot-ftp](https://github.com/alexbredo/honeypot-ftp) - FTP Honeypot. + - [honeypots](https://github.com/qeeqbox/honeypots) - 25 different honeypots in a single pypi package! (dns, ftp, httpproxy, http, https, imap, mysql, pop3, postgres, redis, smb, smtp, socks5, ssh, telnet, vnc, mssql, elastic, ldap, ntp, memcache, snmp, oracle, sip and irc). - [honeytrap](https://github.com/honeytrap/honeytrap) - Advanced Honeypot framework written in Go that can be connected with other honeypot software. - [pyrdp](https://github.com/gosecure/pyrdp) - RDP man-in-the-middle and library for Python 3 with the ability to watch connections live or after the fact. - [troje](https://github.com/dutchcoders/troje/) - Honeypot that runs each connection with the service within a separate LXC container. @@ -115,8 +120,13 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres - Other/random + - [CitrixHoneypot](https://github.com/MalwareTech/CitrixHoneypot) - Detect and log CVE-2019-19781 scan and exploitation attempts. - [Damn Simple Honeypot (DSHP)](https://github.com/naorlivne/dshp) - Honeypot framework with pluggable handlers. + - [dicompot](https://github.com/nsmfoo/dicompot) - DICOM Honeypot. + - [IPP Honey](https://gitlab.com/bontchev/ipphoney) - A honeypot for the Internet Printing Protocol. + - [Log4Pot](https://github.com/thomaspatzke/Log4Pot) - A honeypot for the Log4Shell vulnerability (CVE-2021-44228). - [Masscanned](https://github.com/ivre/masscanned) - Let's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise. + - [medpot](https://github.com/schmalle/medpot) - HL7 / FHIR honeypot. - [NOVA](https://github.com/DataSoft/Nova) - Uses honeypots as detectors, looks like a complete system. - [OpenFlow Honeypot (OFPot)](https://github.com/upa/ofpot) - Redirects traffic for unused IPs to a honeypot, built on POX. - [OpenCanary](https://github.com/thinkst/opencanary) - Modular and decentralised honeypot daemon that runs several canary versions of services that alerts when a service is (ab)used. @@ -319,6 +329,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres - [Blacknet](https://github.com/morian/blacknet) - Multi-head SSH honeypot system. - [Cowrie](https://github.com/cowrie/cowrie) - Cowrie SSH Honeypot (based on kippo). - [DShield docker](https://github.com/xme/dshield-docker) - Docker container running cowrie with DShield output enabled. + - [endlessh](https://github.com/skeeto/endlessh) - SSH tarpit that slowly sends an endless banner. ([docker image](https://hub.docker.com/r/linuxserver/endlessh)) - [HonSSH](https://github.com/tnich/honssh) - Logs all SSH communications between a client and server. - [HUDINX](https://github.com/Cryptix720/HUDINX) - Tiny interaction SSH honeypot engineered in Python to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker. - [Kippo](https://github.com/desaster/kippo) - Medium interaction SSH honeypot. @@ -422,6 +433,10 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres - [Artemnesia VoIP](http://artemisa.sourceforge.net) +- SIP + + - [SentryPeer](https://github.com/SentryPeer/SentryPeer) - Protect your SIP Servers from bad actors. + - IOT Honeypot - [HoneyThing](https://github.com/omererdem/honeything) - TR-069 Honeypot. @@ -469,6 +484,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres - [libemu](https://github.com/buffer/libemu) - Shellcode emulation library, useful for shellcode detection. - Sandbox-as-a-Service + - [Hybrid Analysis](https://www.hybrid-analysis.com) - Free malware analysis service powered by Payload Security that detects and analyzes unknown threats using a unique Hybrid Analysis technology. - [Joebox Cloud](https://jbxcloud.joesecurity.org/login) - Analyzes the behavior of malicious files including PEs, PDFs, DOCs, PPTs, XLSs, APKs, URLs and MachOs on Windows, Android and Mac OS X for suspicious activities. - [VirusTotal](https://www.virustotal.com/) - Analyze suspicious files and URLs to detect types of malware, and automatically share them with the security community. @@ -487,6 +503,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres - [honeypotDisplay](https://github.com/Joss-Steward/honeypotDisplay) - Flask website which displays data gathered from an SSH Honeypot. - Visualization + - [Acapulco](https://github.com/hgascon/acapulco) - Automated Attack Community Graph Construction. - [Afterglow Cloud](https://github.com/ayrus/afterglow-cloud) - [Afterglow](http://afterglow.sourceforge.net/) @@ -513,5 +530,6 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres - [honeypotpi](https://github.com/free5ty1e/honeypotpi) - Script for turning a Raspberry Pi into a HoneyPot Pi. - Research Papers + - [Honeypot research papers](https://github.com/shbhmsingh72/Honeypot-Research-Papers) - PDFs of research papers on honeypots. - [vEYE](https://link.springer.com/article/10.1007%2Fs10115-008-0137-3) - Behavioral footprinting for self-propagating worm detection and profiling.