Honeytrap by Till Mannw Logo

Honeytrap by Till Mannw

0
Free
Visit Website

Honeytrap is a low-interaction honeypot and network security tool written to catch attacks against TCP and UDP services. In its default configuration, it runs as a daemon and starts server processes on demand when a connection attempt to a port is made. Different modes of operation are available that control how connections are handled. In normal mode, a server sends arbitrary data provided in template files as a basic means to emulate well-known protocols. Many automated attack tools will be fooled and continue with the attack dialog. A popular mode is the so-called mirror mode in which incoming connections are proxied back to the initiator. This trick eliminates the need for protocol emulation in many cases. A third mode, the proxy mode, allows forwarding of specific sessions to other systems, e.g., high-interaction honeypots. Plugins: A module API provides an easy way to write custom extensions that are dynamically loaded into the honeypot. Arriving attack data is assembled to a so-called attack string that can be saved to files or a SQL database for manual investigation. Honeytrap comes with different plugins that run on these attack strings to extract additional info.

FEATURES

ALTERNATIVES

A DNS server for executing DNS Rebinding attacks

A low-interaction SSH honeypot tool for recording authentication attempts.

A low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques.

A honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689

A collection of scripts for debugging SSRF, blind XSS, and XXE vulnerabilities

GasPot is a honeypot simulation tool for Gas Station tanks in the oil and gas industry.

GHH is a honeypot tool to defend against search engine hackers using Google as a hacking tool.

Find domains and subdomains related to a given domain