An active and aggressive honeypot tool for network security.
Honeytrap is a low-interaction honeypot and network security tool written to catch attacks against TCP and UDP services. In its default configuration, it runs as a daemon and starts server processes on demand when a connection attempt to a port is made. Different modes of operation are available that control how connections are handled. In normal mode, a server sends arbitrary data provided in template files as a basic means to emulate well-known protocols. Many automated attack tools will be fooled and continue with the attack dialog. A popular mode is the so-called mirror mode in which incoming connections are proxied back to the initiator. This trick eliminates the need for protocol emulation in many cases. A third mode, the proxy mode, allows forwarding of specific sessions to other systems, e.g., high-interaction honeypots. Plugins: A module API provides an easy way to write custom extensions that are dynamically loaded into the honeypot. Arriving attack data is assembled to a so-called attack string that can be saved to files or a SQL database for manual investigation. Honeytrap comes with different plugins that run on these attack strings to extract additional info.
An active and aggressive honeypot tool for network security.
A honeypot system that detects and identifies attack commands, recon attempts, and download commands, mimicking a vulnerable Elasticsearch instance.
A PoC tool for utilizing GPT3.5 in developing an SMTP honeypot.
Open-source honeypot tool for detecting and analyzing malicious activities in the Apache Struts exploit.
A modern directory scanner that can be used to find hidden directories and files on a web server.
A honeypot agent for running honeypots with service and data at threatwar.com.