Honeytrap by Till Mannw Logo

Honeytrap by Till Mannw

0
Free
Visit Website

Honeytrap is a low-interaction honeypot and network security tool written to catch attacks against TCP and UDP services. In its default configuration, it runs as a daemon and starts server processes on demand when a connection attempt to a port is made. Different modes of operation are available that control how connections are handled. In normal mode, a server sends arbitrary data provided in template files as a basic means to emulate well-known protocols. Many automated attack tools will be fooled and continue with the attack dialog. A popular mode is the so-called mirror mode in which incoming connections are proxied back to the initiator. This trick eliminates the need for protocol emulation in many cases. A third mode, the proxy mode, allows forwarding of specific sessions to other systems, e.g., high-interaction honeypots. Plugins: A module API provides an easy way to write custom extensions that are dynamically loaded into the honeypot. Arriving attack data is assembled to a so-called attack string that can be saved to files or a SQL database for manual investigation. Honeytrap comes with different plugins that run on these attack strings to extract additional info.

FEATURES

ALTERNATIVES

Distributed low interaction honeypot with Agent/Master design supporting various protocol handlers.

A subdomain finder tool

A crawler-based low-interaction client honeypot for exposing website threats.

A honeypot tool to detect and log CVE-2019-19781 scan and exploitation attempts.

A tool to identify potential subdomain takeovers by checking if a CNAME record resolves to the scope address.

An extensible and open-source system for running, monitoring, and managing honeypots with advanced features.

A honeypot for malware that spreads via USB storage devices, detecting infections without further information.

An active and aggressive honeypot tool for network security.