Awesome-Mirrors/awesome-honeypots
1
0
Fork 0
mirror of https://github.com/paralax/awesome-honeypots.git synced 2024-10-01 06:35:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

added express-honeypot

Browse Source
This commit is contained in:
christophe bellec 2022-01-11 19:12:26 +01:00
parent 522c2c6d66
commit c9e5661e45
1 changed files with 348 additions and 287 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
README.md
View File

@ -8,6 +8,8 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
# Contents
- [Awesome Honeypots ![Awesome Honeypots](https://github.com/sindresorhus/awesome)](#awesome-honeypots-)
- [Contents](#contents)
- [Related Lists](#related-lists)
- [Honeypots](#honeypots)
- [Honeyd Tools](#honeyd-tools)
@ -23,6 +25,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
## Honeypots
- Database Honeypots
- [Delilah](https://github.com/SecurityTW/delilah) - Elasticsearch Honeypot written in Python (originally from Novetta).
- [ESPot](https://github.com/mycert/ESPot) - Elasticsearch honeypot written in NodeJS, to capture every attempts to exploit CVE-2014-3120.
- [Elastic honey](https://github.com/jordan-wright/elastichoney) - Simple Elasticsearch Honeypot.
@ -34,6 +37,8 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [sticky_elephant](https://github.com/betheroot/sticky_elephant) - Medium interaction postgresql honeypot.
- Web honeypots
- [Express honeypot](https://github.com/christophe77/express-honeypot) - RFI & LFI honeypot using nodeJS and express.
- [EoHoneypotBundle](https://github.com/eymengunay/EoHoneypotBundle) - Honeypot type for Symfony2 forms.
- [Glastopf](https://github.com/mushorg/glastopf) - Web Application Honeypot.
- [Google Hack Honeypot](http://ghh.sourceforge.net) - Designed to provide reconnaissance against attackers that use search engines as a hacking tool against your resources.
@ -67,6 +72,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [wordpot](https://github.com/gbrindisi/wordpot) - WordPress Honeypot.
- Service Honeypots
- [ADBHoney](https://github.com/huuck/ADBHoney) - Low interaction honeypot that simulates an Android device running Android Debug Bridge (ADB) server process.
- [AMTHoneypot](https://github.com/packetflare/amthoneypot) - Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689.
- [DolosHoneypot](https://github.com/Marist-Innovation-Lab/DolosHoneypot) - SDN (software defined networking) honeypot.
@ -92,12 +98,15 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [troje](https://github.com/dutchcoders/troje/) - Honeypot that runs each connection with the service within a separate LXC container.
- Distributed Honeypots
- [DemonHunter](https://github.com/RevengeComing/DemonHunter) - Low interaction honeypot server.
- Anti-honeypot stuff
- [kippo_detect](https://github.com/andrew-morris/kippo_detect) - Offensive component that detects the presence of the kippo honeypot.
- ICS/SCADA honeypots
- [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA honeypot.
- [GasPot](https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, common in the oil and gas industry.
- [SCADA honeynet](http://scadahoneynet.sourceforge.net) - Building Honeypots for Industrial Networks.
@ -105,6 +114,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [scada-honeynet](http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/) - Mimics many of the services from a popular PLC and better helps SCADA researchers understand potential risks of exposed control system devices.
- Other/random
- [Damn Simple Honeypot (DSHP)](https://github.com/naorlivne/dshp) - Honeypot framework with pluggable handlers.
- [NOVA](https://github.com/DataSoft/Nova) - Uses honeypots as detectors, looks like a complete system.
- [OpenFlow Honeypot (OFPot)](https://github.com/upa/ofpot) - Redirects traffic for unused IPs to a honeypot, built on POX.
@ -113,76 +123,97 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [miniprint](https://github.com/sa7mon/miniprint) - A medium interaction printer honeypot.
- Botnet C2 tools
- [Hale](https://github.com/pjlantz/Hale) - Botnet command and control monitor.
- [dnsMole](https://code.google.com/archive/p/dns-mole/) - Analyses DNS traffic and potentionaly detect botnet command and control server activity, along with infected hosts.
- IPv6 attack detection tool
- [ipv6-attack-detector](https://github.com/mzweilin/ipv6-attack-detector/) - Google Summer of Code 2012 project, supported by The Honeynet Project organization.
- Dynamic code instrumentation toolkit
- [Frida](https://www.frida.re) - Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android.
- Tool to convert website to server honeypots
- [HIHAT](http://hihat.sourceforge.net/) - Transform arbitrary PHP applications into web-based high-interaction Honeypots.
- Malware collector
- [Kippo-Malware](https://bruteforcelab.com/kippo-malware) - Python script that will download all malicious files stored as URLs in a Kippo SSH honeypot database.
- Distributed sensor deployment
- [Community Honey Network](https://communityhoneynetwork.readthedocs.io/en/stable/) - CHN aims to make deployments honeypots and honeypot management tools easy and flexible. The default deployment method uses Docker Compose and Docker to deploy with a few simple commands.
- [Modern Honey Network](https://github.com/threatstream/mhn) - Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management.
- Network Analysis Tool
- [Tracexploit](https://code.google.com/archive/p/tracexploit/) - Replay network packets.
- Log anonymizer
- [LogAnon](http://code.google.com/archive/p/loganon/) - Log anonymization library that helps having anonymous logs consistent between logs and network captures.
- Low interaction honeypot (router back door)
- [Honeypot-32764](https://github.com/knalli/honeypot-for-tcp-32764) - Honeypot for router backdoor (TCP 32764).
- [WAPot](https://github.com/lcashdol/WAPot) - Honeypot that can be used to observe traffic directed at home routers.
- honeynet farm traffic redirector
- [Honeymole](https://web.archive.org/web/20100326040550/http://www.honeynet.org.pt:80/index.php/HoneyMole) - Deploy multiple sensors that redirect traffic to a centralized collection of honeypots.
- HTTPS Proxy
- [mitmproxy](https://mitmproxy.org/) - Allows traffic flows to be intercepted, inspected, modified, and replayed.
- System instrumentation
- [Sysdig](https://sysdig.com/opensource/) - Open source, system-level exploration allows one to capture system state and activity from a running GNU/Linux instance, then save, filter, and analyze the results.
- [Fibratus](https://github.com/rabbitstack/fibratus) - Tool for exploration and tracing of the Windows kernel.
- Honeypot for USB-spreading malware
- [Ghost-usb](https://github.com/honeynet/ghost-usb-honeypot) - Honeypot for malware that propagates via USB storage devices.
- Data Collection
- [Kippo2MySQL](https://bruteforcelab.com/kippo2mysql) - Extracts some very basic stats from Kippo’s text-based log files and inserts them in a MySQL database.
- [Kippo2ElasticSearch](https://bruteforcelab.com/kippo2elasticsearch) - Python script to transfer data from a Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster).
- Passive network audit framework parser
- [Passive Network Audit Framework (pnaf)](https://github.com/jusafing/pnaf) - Framework that combines multiple passive and automated analysis techniques in order to provide a security assessment of network platforms.
- VM monitoring and tools
- [Antivmdetect](https://github.com/nsmfoo/antivmdetection) - Script to create templates to use with VirtualBox to make VM detection harder.
- [VMCloak](https://github.com/hatching/vmcloak) - Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
- [vmitools](http://libvmi.com/) - C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine.
- Binary debugger
- [Hexgolems - Pint Debugger Backend](https://github.com/hexgolems/pint) - Debugger backend and LUA wrapper for PIN.
- [Hexgolems - Schem Debugger Frontend](https://github.com/hexgolems/schem) - Debugger frontend.
- Mobile Analysis Tool
- [Androguard](https://github.com/androguard/androguard) - Reverse engineering, Malware and goodware analysis of Android applications and more.
- [APKinspector](https://github.com/honeynet/apkinspector/) - Powerful GUI tool for analysts to analyze the Android applications.
- Low interaction honeypot
- [Honeyperl](https://sourceforge.net/projects/honeyperl/) - Honeypot software based in Perl with plugins developed for many functions like : wingates, telnet, squid, smtp, etc.
- [T-Pot](https://github.com/dtag-dev-sec/tpotce) - All in one honeypot appliance from telecom provider T-Mobile
- Honeynet data fusion
- [HFlow2](https://projects.honeynet.org/hflow) - Data coalesing tool for honeynet/network analysis.
- Server
- [Amun](http://amunhoney.sourceforge.net) - Vulnerability emulation honeypot.
- [Artillery](https://github.com/trustedsec/artillery/) - Open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
- [Bait and Switch](http://baitnswitch.sourceforge.net) - Redirects all hostile traffic to a honeypot that is partially mirroring your production system.
@ -216,32 +247,38 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [telnetlogger](https://github.com/robertdavidgraham/telnetlogger) - Telnet honeypot designed to track the Mirai botnet.
- [vnclowpot](https://github.com/magisterquis/vnclowpot) - Low interaction VNC honeypot.
- IDS signature generation
- [Honeycomb](http://www.icir.org/christian/honeycomb/) - Automated signature creation using honeypots.
- Lookup service for AS-numbers and prefixes
- [CC2ASN](http://www.cc2asn.com/) - Simple lookup service for AS-numbers and prefixes belonging to any given country in the world.
- Data Collection / Data Sharing
- [HPfriends](http://hpfriends.honeycloud.net/#/home) - Honeypot data-sharing platform.
- [hpfriends - real-time social data-sharing](https://heipei.io/sigint-hpfriends/) - Presentation about HPFriends feed system
- [HPFeeds](https://github.com/rep/hpfeeds/) - Lightweight authenticated publish-subscribe protocol.
- Central management tool
- [PHARM](http://www.nepenthespharm.com/) - Manage, report, and analyze your distributed Nepenthes instances.
- Network connection analyzer
- [Impost](http://impost.sourceforge.net/) - Network security auditing tool designed to analyze the forensics behind compromised and/or vulnerable daemons.
- Honeypot deployment
- [Modern Honeynet Network](http://threatstream.github.io/mhn/) - Streamlines deployment and management of secure honeypots.
- Honeypot extensions to Wireshark
- [Wireshark Extensions](https://www.honeynet.org/project/WiresharkExtensions) - Apply Snort IDS rules and signatures against packet capture files using Wireshark.
- Client
- [CWSandbox / GFI Sandbox](https://www.gfi.com/products-and-solutions/all-products)
- [Capture-HPC-Linux](https://redmine.honeynet.org/projects/linux-capture-hpc/wiki)
- [Capture-HPC-NG](https://github.com/CERT-Polska/HSN-Capture-HPC-NG)
@ -263,16 +300,20 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [YALIH (Yet Another Low Interaction Honeyclient)](https://github.com/Masood-M/yalih) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques.
- Honeypot
- [Deception Toolkit](http://www.all.net/dtk/dtk.html)
- [IMHoneypot](https://github.com/mushorg/imhoneypot)
- PDF document inspector
- [peepdf](https://github.com/jesparza/peepdf) - Powerful Python tool to analyze PDF documents.
- Hybrid low/high interaction honeypot
- [HoneyBrid](http://honeybrid.sourceforge.net)
- SSH Honeypots
- [Blacknet](https://github.com/morian/blacknet) - Multi-head SSH honeypot system.
- [Cowrie](https://github.com/cowrie/cowrie) - Cowrie SSH Honeypot (based on kippo).
- [DShield docker](https://github.com/xme/dshield-docker) - Docker container running cowrie with DShield output enabled.
@ -307,30 +348,39 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [twisted-honeypots](https://github.com/lanjelot/twisted-honeypots) - SSH, FTP and Telnet honeypots based on Twisted.
- Distributed sensor project
- [DShield Web Honeypot Project](https://sites.google.com/site/webhoneypotsite/)
- A pcap analyzer
- [Honeysnap](https://projects.honeynet.org/honeysnap/)
- Network traffic redirector
- [Honeywall](https://projects.honeynet.org/honeywall/)
- Honeypot Distribution with mixed content
- [HoneyDrive](https://bruteforcelab.com/honeydrive)
- Honeypot sensor
- [Honeeepi](https://redmine.honeynet.org/projects/honeeepi/wiki) - Honeypot sensor on a Raspberry Pi based on a customized Raspbian OS.
- File carving
- [TestDisk & PhotoRec](https://www.cgsecurity.org/)
- Behavioral analysis tool for win32
- [Capture BAT](https://www.honeynet.org/node/315)
- Live CD
- [DAVIX](https://www.secviz.org/node/89) - The DAVIX Live CD.
- Spamtrap
- [Mail::SMTP::Honeypot](https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - Perl module that appears to provide the functionality of a standard SMTP server.
- [Mailoney](https://github.com/awhitehatter/mailoney) - SMTP honeypot, Open Relay, Cred Harvester written in python.
- [SendMeSpamIDS.py](https://github.com/johestephan/VerySimpleHoneypot) - Simple SMTP fetch all IDS and analyzer.
@ -342,15 +392,19 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [spamd](http://man.openbsd.org/cgi-bin/man.cgi?query=spamd%26apropos=0%26sektion=0%26manpath=OpenBSD+Current%26arch=i386%26format=html)
- Commercial honeynet
- [Cymmetria Mazerunner](ttps://cymmetria.com/products/mazerunner/) - Leads attackers away from real targets and creates a footprint of the attack.
- Server (Bluetooth)
- [Bluepot](https://github.com/andrewmichaelsmith/bluepot)
- Dynamic analysis of Android apps
- [Droidbox](https://code.google.com/archive/p/droidbox/)
- Dockerized Low Interaction packaging
- [Docker honeynet](https://github.com/sreinhardt/Docker-Honeynet) - Several Honeynet tools set up for Docker containers.
- [Dockerized Thug](https://hub.docker.com/r/honeynet/thug/) - Dockerized [Thug](https://github.com/buffer/thug) to analyze malicious web content.
- [Dockerpot](https://github.com/mrschyte/dockerpot) - Docker based honeypot.
@ -359,12 +413,15 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [mhn-core-docker](https://github.com/MattCarothers/mhn-core-docker) - Core elements of the Modern Honey Network implemented in Docker.
- Network analysis
- [Quechua](https://bitbucket.org/zaccone/quechua)
- SIP Server
- [Artemnesia VoIP](http://artemisa.sourceforge.net)
- IOT Honeypot
- [HoneyThing](https://github.com/omererdem/honeything) - TR-069 Honeypot.
- [Kako](https://github.com/darkarnium/kako) - Honeypots for a number of well known and deployed embedded device vulnerabilities.
@ -378,25 +435,28 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
## Honeyd Tools
- Honeyd plugin
- [Honeycomb](http://www.honeyd.org/tools.php)
- Honeyd viewer
- [Honeyview](http://honeyview.sourceforge.net/)
- Honeyd to MySQL connector
- [Honeyd2MySQL](https://bruteforcelab.com/honeyd2mysql)
- A script to visualize statistics from honeyd
- [Honeyd-Viz](https://bruteforcelab.com/honeyd-viz)
- Honeyd stats
- [Honeydsum.pl](https://github.com/DataSoft/Honeyd/blob/master/scripts/misc/honeydsum-v0.3/honeydsum.pl)
## Network and Artifact Analysis
- Sandbox
- [Argos](http://www.few.vu.nl/argos/) - Emulator for capturing zero-day attacks.
- [COMODO automated sandbox](https://help.comodo.com/topic-72-1-451-4768-.html)
- [Cuckoo](https://cuckoosandbox.org/) - Leading open source automated malware analysis system.
@ -406,7 +466,6 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [imalse](https://github.com/hbhzwj/imalse) - Integrated MALware Simulator and Emulator.
- [libemu](https://github.com/buffer/libemu) - Shellcode emulation library, useful for shellcode detection.
- Sandbox-as-a-Service
- [Hybrid Analysis](https://www.hybrid-analysis.com) - Free malware analysis service powered by Payload Security that detects and analyzes unknown threats using a unique Hybrid Analysis technology.
- [Joebox Cloud](https://jbxcloud.joesecurity.org/login) - Analyzes the behavior of malicious files including PEs, PDFs, DOCs, PPTs, XLSs, APKs, URLs and MachOs on Windows, Android and Mac OS X for suspicious activities.
@ -416,6 +475,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
## Data Tools
- Front Ends
- [DionaeaFR](https://github.com/rubenespadas/DionaeaFR) - Front Web to Dionaea low-interaction honeypot.
- [Django-kippo](https://github.com/jedie/django-kippo) - Django App for kippo SSH Honeypot.
- [Shockpot-Frontend](https://github.com/GovCERT-CZ/Shockpot-Frontend) - Full featured script to visualize statistics from a Shockpot honeypot.
@ -444,6 +504,7 @@ Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindres
- [Honeypot (Dionaea and kippo) setup script](https://github.com/andrewmichaelsmith/honeypot-setup-script/)
- Deployment
- [Dionaea and EC2 in 20 Minutes](http://andrewmichaelsmith.com/2012/03/dionaea-honeypot-on-ec2-in-20-minutes/) - Tutorial on setting up Dionaea on an EC2 instance.
- [Using a Raspberry Pi honeypot to contribute data to DShield/ISC](https://isc.sans.edu/diary/22680) - The Raspberry Pi based system will allow us to maintain one code base that will make it easier to collect rich logs beyond firewall logs.
- [honeypotpi](https://github.com/free5ty1e/honeypotpi) - Script for turning a Raspberry Pi into a HoneyPot Pi.