T-Pot - The All In One Multi Honeypot Platform
T-Pot is the all in one, optionally distributed, multiarch (amd64, arm64) honeypot plattform, supporting 20+ honeypots and countless visualization options using the Elastic Stack, animated live attack maps and lots of security tools to further improve the deception experience. TL;DR Meet the system requirements. The T-Pot installation needs at least 8-16 GB RAM, 128 GB free disk space as well as a working (outgoing non-filtered) internet connection. Download or use a running, supported distribution. Install the ISO with as minimal packages / services as possible (ssh required) Install curl: $ sudo [apt, dnf, zypper] install curl if not installed already Run installer as non-root from $HOME: env bash -c "$(curl -sL https://github.com/telekom-security/tpotce/raw/master/install.sh)" Follow instructions, read messages, check for possible port conflicts and reboot Table of Contents T-Pot - The All In One Multi Honeypot Platform TL;DR Table of Contents Disclaimer Technical Concept Technical Architecture Services User Types System Requirements Running in a VM Running on Hardware Running in a Cloud Required Ports System Placement Installation
FEATURES
ALTERNATIVES
A honeypot tool to mimic the router backdoor 'TCP32764' found in various router firmwares, providing a way to test for vulnerabilities.
SMTP honeypot tool with configurable response messages, email storage, and automatic information extraction.
A configurable DNS honeypot with SQLite logging and Docker support.
PINNED
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
PTJunior
An AI-powered penetration testing platform that autonomously discovers, exploits, and documents vulnerabilities while generating NIST-compliant reports.
CTIChef.com Detection Feeds
A tiered cyber threat intelligence service providing detection rules from public repositories with varying levels of analysis, processing, and guidance for security teams.
ImmuniWeb® Discovery
ImmuniWeb Discovery is an attack surface management platform that continuously monitors an organization's external digital assets for security vulnerabilities, misconfigurations, and threats across domains, applications, cloud resources, and the dark web.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.