Honeypots

Image of dripping honey with honeypots text

Introduction

A honeypot is a prepared target to mimic a real system or service in the hope to attract attackers. The goal is to collect more information about attacks and methods used.

Honeypot technology is typically used by those who are interested in protecting their networks or want to collect tools that are commonly used during attacks. It can be a great way to learn and gives the ability to study collected samples like malware and exploits.

This category of honeypots contains all reviewed tools in this area. Depending on your goal, you can select a generic honeypot tool or one that is focused on providing a specific service.

Usage

Honeypots are typically used for intelligence gathering, malware research, threat discovery.

Users for these tools include forensic specialists, malware analysts, security professionals, system administrators.

Tools

Cowrie (SSH/telnet honeypot)

information gathering, learning, security monitoring, threat discovery

Cowrie is a honeypot to emulate SSH and telnet services. It can be used to learn attack methods and as an additional layer for security monitoring.

Dionaea (honeypot)

learning, threat discovery

Dionaea is a honeypot that can emulate a range of services like FTP, HTTP, MySQL, and SMB. It can be used to see and learn how attackers work.

Dockpot (SSH honeypot based on Docker)

learning, threat discovery

Using an SSH honeypot is a good way to learn about common attacks on the SSH service. It can provide insights on the number of scans and probes on the network.

Glastopf (honeypot)

Glastopf is a honeypot for web applications. It is written in Python and collects all kind of attacks against it for further analysis.

Heralding (honeypot to catch credentials)

Heralding is a simple honeypot to collect credentials. It supports common protocols like FTP, SSH, HTTP, etc.

HonSSH (SSH honeypot)

learning, threat discovery

HonSSH is a high-interaction SSH honeypot to collect information about attackers that target the SSH service.

Kippo (SSH honeypot)

information gathering, intrusion detection, security monitoring

Kippo is a honeypot for SSH connections and written in Python. It can be used to learn about the scripts and attacks that are commonly used against SSH.

Kojoney (SSH honeypot)

learning, threat discovery

Kojoney2 (SSH honeypot)

learning, threat discovery

Kojoney2 is an SSH honeypot based on Kojoney by Jose Antonio Coret. It can be used to learn about threats by mimicking an SSH service.

mehrai (telnet honeypot)

learning, network security monitoring, security monitoring

Honeypots like mehrai can be used to learn more about incoming attacks. It might be useful to determine threats to your network or about the steps that attackers perform.

MTPot (telnet honeypot)

learning, threat discovery

MTPot is a so-called telnet honeypot that allows to bind and listen on a specific port. It can be configured to allow specific commands and the related responses to return. The tool also performs fingerprinting to discover what type of attack is occuring and send these details via syslog.

sshesame (SSH honeypot)

learning, threat discovery

A honeypot can provide valuable insights on commands that automated scripts perform or attackers. By running a honeypot like sshesame, connection details and commands are stored for later analysis. The system itself won't execute the actual commands, to prevent any damage to it.

SSHHiPot (high-interaction SSH honeypot)

learning, threat discovery

SSHHiPot is a high-interaction SSH honeypot. It captures connections and commands that are to be performed, for the purpose of learning about possible threats.

SSH Honeypot (SSH honeypot)

learning, threat discovery

SSH Honeypot is as the name implies a honeypot to emulate the SSH service. It can be used to learn about threats and commands used by attackers.

TANNER (intelligence engine for SNARE tool)

security monitoring

TANNER is the 'brain' of the SNARE tool. It evaluates its events and alters the responses to incoming requests depending on the type of attacks.

Thug (low-interaction honeyclient)

learning, malware analysis, threat discovery

The honeypot concept is a well-known technique to collect attack patterns on servers and systems. Tools like Thug are considered to be a honeyclient, or client honeypot. These tools collect attacks against client applications. For example by mimicking a web application and visit a malicious page to see if any code is attacking the application.

Missing a favorite tool in this list? Share a tool suggestion and we will review it.