Delilah is a honeypot system inspired by Jordan Wright’s Elastichoney that detects and identifies attack commands, recon attempts, and download commands. It acts as a vulnerable Elasticsearch instance that detects and identifies attack commands, recon attempts, and download commands. Whenever an attacker issues a download command, Delilah will attempt to download the file the attacker is attempting to introduce on a victim's system. Whenever Delilah detects an attacker's commands, a notification email is sent to one or more email addresses in order to alert analysts in real-time of incoming attacks. Delilah provides a variety of configurable parameters to mimic Elasticsearch instances and prevent an attacker from easily determining that they are interacting with a honeypot. Multiple Delilah nodes can be installed to form a network of sensors. To more easily view the sensor network, analysts should use the
FEATURES
This tool is not verified yet and doesn't have listed features.
Did you submit the verified tool? Sign in to add features.
Are you the author? Claim the tool by clicking the icon above. After claiming, you can add features.
ALTERNATIVES
A web honeypot tool for detecting and monitoring potential attacks on phpMyAdmin installations.
A tool to leak git repositories from misconfigured websites
A subset of the Modern Honey Network project set up to run in docker, including hpfeeds broker, cowrie honeypot, and dionaea honeypot.
A honeypot for the Log4Shell vulnerability (CVE-2021-44228) with various detection and logging features.
Building Honeypots for Industrial Networks using Honeyd and simulating SCADA, DCS, and PLC architectures.