├── .travis.yml ├── CONTRIBUTING.md ├── LICENSE ├── README.md ├── README_CN.md └── awesome-check.py /.travis.yml: -------------------------------------------------------------------------------- 1 | language: ruby 2 | rvm: 3 | - 2.2 4 | before_script: 5 | - gem install awesome_bot 6 | script: 7 | - awesome_bot README.md --white-list https://github.com/sindresorhus/awesome,http://hpfriends.honeycloud.net/#/home,https://malwr.com/ 8 | - awesome_bot README_CN.md --white-list https://github.com/sindresorhus/awesome,http://hpfriends.honeycloud.net/#/home,https://malwr.com/ 9 | 10 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contribution Guidelines 2 | 3 | Please ensure your pull request adheres to the following guidelines: 4 | 5 | - Search previous suggestions before making a new one, as yours may be a duplicate. 6 | - Make an individual pull request for each suggestion. 7 | - Use the following format: `[PACKAGE](LINK) - DESCRIPTION.` 8 | - New categories, or improvements to the existing categorization are welcome. 9 | - Keep descriptions short and simple, but descriptive. 10 | - End all descriptions with a full stop/period. 11 | - Check your spelling and grammar. 12 | - Make sure your text editor is set to remove trailing whitespace. 13 | 14 | Your contributions are always welcome! Thank you for your suggestions! 15 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | The Artistic License 2.0 2 | 3 | Copyright (c) 2015-2024 jose nazario 4 | 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | This license establishes the terms under which a given free software 11 | Package may be copied, modified, distributed, and/or redistributed. 12 | The intent is that the Copyright Holder maintains some artistic 13 | control over the development of that Package while still keeping the 14 | Package available as open source and free software. 15 | 16 | You are always permitted to make arrangements wholly outside of this 17 | license directly with the Copyright Holder of a given Package. If the 18 | terms of this license do not permit the full use that you propose to 19 | make of the Package, you should contact the Copyright Holder and seek 20 | a different licensing arrangement. 21 | 22 | Definitions 23 | 24 | "Copyright Holder" means the individual(s) or organization(s) 25 | named in the copyright notice for the entire Package. 26 | 27 | "Contributor" means any party that has contributed code or other 28 | material to the Package, in accordance with the Copyright Holder's 29 | procedures. 30 | 31 | "You" and "your" means any person who would like to copy, 32 | distribute, or modify the Package. 33 | 34 | "Package" means the collection of files distributed by the 35 | Copyright Holder, and derivatives of that collection and/or of 36 | those files. A given Package may consist of either the Standard 37 | Version, or a Modified Version. 38 | 39 | "Distribute" means providing a copy of the Package or making it 40 | accessible to anyone else, or in the case of a company or 41 | organization, to others outside of your company or organization. 42 | 43 | "Distributor Fee" means any fee that you charge for Distributing 44 | this Package or providing support for this Package to another 45 | party. It does not mean licensing fees. 46 | 47 | "Standard Version" refers to the Package if it has not been 48 | modified, or has been modified only in ways explicitly requested 49 | by the Copyright Holder. 50 | 51 | "Modified Version" means the Package, if it has been changed, and 52 | such changes were not explicitly requested by the Copyright 53 | Holder. 54 | 55 | "Original License" means this Artistic License as Distributed with 56 | the Standard Version of the Package, in its current version or as 57 | it may be modified by The Perl Foundation in the future. 58 | 59 | "Source" form means the source code, documentation source, and 60 | configuration files for the Package. 61 | 62 | "Compiled" form means the compiled bytecode, object code, binary, 63 | or any other form resulting from mechanical transformation or 64 | translation of the Source form. 65 | 66 | 67 | Permission for Use and Modification Without Distribution 68 | 69 | (1) You are permitted to use the Standard Version and create and use 70 | Modified Versions for any purpose without restriction, provided that 71 | you do not Distribute the Modified Version. 72 | 73 | 74 | Permissions for Redistribution of the Standard Version 75 | 76 | (2) You may Distribute verbatim copies of the Source form of the 77 | Standard Version of this Package in any medium without restriction, 78 | either gratis or for a Distributor Fee, provided that you duplicate 79 | all of the original copyright notices and associated disclaimers. At 80 | your discretion, such verbatim copies may or may not include a 81 | Compiled form of the Package. 82 | 83 | (3) You may apply any bug fixes, portability changes, and other 84 | modifications made available from the Copyright Holder. The resulting 85 | Package will still be considered the Standard Version, and as such 86 | will be subject to the Original License. 87 | 88 | 89 | Distribution of Modified Versions of the Package as Source 90 | 91 | (4) You may Distribute your Modified Version as Source (either gratis 92 | or for a Distributor Fee, and with or without a Compiled form of the 93 | Modified Version) provided that you clearly document how it differs 94 | from the Standard Version, including, but not limited to, documenting 95 | any non-standard features, executables, or modules, and provided that 96 | you do at least ONE of the following: 97 | 98 | (a) make the Modified Version available to the Copyright Holder 99 | of the Standard Version, under the Original License, so that the 100 | Copyright Holder may include your modifications in the Standard 101 | Version. 102 | 103 | (b) ensure that installation of your Modified Version does not 104 | prevent the user installing or running the Standard Version. In 105 | addition, the Modified Version must bear a name that is different 106 | from the name of the Standard Version. 107 | 108 | (c) allow anyone who receives a copy of the Modified Version to 109 | make the Source form of the Modified Version available to others 110 | under 111 | 112 | (i) the Original License or 113 | 114 | (ii) a license that permits the licensee to freely copy, 115 | modify and redistribute the Modified Version using the same 116 | licensing terms that apply to the copy that the licensee 117 | received, and requires that the Source form of the Modified 118 | Version, and of any works derived from it, be made freely 119 | available in that license fees are prohibited but Distributor 120 | Fees are allowed. 121 | 122 | 123 | Distribution of Compiled Forms of the Standard Version 124 | or Modified Versions without the Source 125 | 126 | (5) You may Distribute Compiled forms of the Standard Version without 127 | the Source, provided that you include complete instructions on how to 128 | get the Source of the Standard Version. Such instructions must be 129 | valid at the time of your distribution. If these instructions, at any 130 | time while you are carrying out such distribution, become invalid, you 131 | must provide new instructions on demand or cease further distribution. 132 | If you provide valid instructions or cease distribution within thirty 133 | days after you become aware that the instructions are invalid, then 134 | you do not forfeit any of your rights under this license. 135 | 136 | (6) You may Distribute a Modified Version in Compiled form without 137 | the Source, provided that you comply with Section 4 with respect to 138 | the Source of the Modified Version. 139 | 140 | 141 | Aggregating or Linking the Package 142 | 143 | (7) You may aggregate the Package (either the Standard Version or 144 | Modified Version) with other packages and Distribute the resulting 145 | aggregation provided that you do not charge a licensing fee for the 146 | Package. Distributor Fees are permitted, and licensing fees for other 147 | components in the aggregation are permitted. The terms of this license 148 | apply to the use and Distribution of the Standard or Modified Versions 149 | as included in the aggregation. 150 | 151 | (8) You are permitted to link Modified and Standard Versions with 152 | other works, to embed the Package in a larger work of your own, or to 153 | build stand-alone binary or bytecode versions of applications that 154 | include the Package, and Distribute the result without restriction, 155 | provided the result does not expose a direct interface to the Package. 156 | 157 | 158 | Items That are Not Considered Part of a Modified Version 159 | 160 | (9) Works (including, but not limited to, modules and scripts) that 161 | merely extend or make use of the Package, do not, by themselves, cause 162 | the Package to be a Modified Version. In addition, such works are not 163 | considered parts of the Package itself, and are not subject to the 164 | terms of this license. 165 | 166 | 167 | General Provisions 168 | 169 | (10) Any use, modification, and distribution of the Standard or 170 | Modified Versions is governed by this Artistic License. By using, 171 | modifying or distributing the Package, you accept this license. Do not 172 | use, modify, or distribute the Package, if you do not accept this 173 | license. 174 | 175 | (11) If your Modified Version has been derived from a Modified 176 | Version made by someone other than you, you are nevertheless required 177 | to ensure that your Modified Version complies with the requirements of 178 | this license. 179 | 180 | (12) This license does not grant you the right to use any trademark, 181 | service mark, tradename, or logo of the Copyright Holder. 182 | 183 | (13) This license includes the non-exclusive, worldwide, 184 | free-of-charge patent license to make, have made, use, offer to sell, 185 | sell, import and otherwise transfer the Package with respect to any 186 | patent claims licensable by the Copyright Holder that are necessarily 187 | infringed by the Package. If you institute patent litigation 188 | (including a cross-claim or counterclaim) against any party alleging 189 | that the Package constitutes direct or contributory patent 190 | infringement, then this Artistic License to you shall terminate on the 191 | date that such litigation is filed. 192 | 193 | (14) Disclaimer of Warranty: 194 | THE PACKAGE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS "AS 195 | IS' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES. THE IMPLIED 196 | WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR 197 | NON-INFRINGEMENT ARE DISCLAIMED TO THE EXTENT PERMITTED BY YOUR LOCAL 198 | LAW. UNLESS REQUIRED BY LAW, NO COPYRIGHT HOLDER OR CONTRIBUTOR WILL 199 | BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL 200 | DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THE PACKAGE, EVEN IF 201 | ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 202 | 203 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Awesome Honeypots [![Awesome Honeypots](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/sindresorhus/awesome) 2 | 3 | A curated list of awesome honeypots, plus related components and much more, divided into categories such as Web, services, and others, with a focus on free and open source projects. 4 | 5 | There is no pre-established order of items in each category, the order is for contribution. If you want to contribute, please read the [guide](CONTRIBUTING.md). 6 | 7 | Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindresorhus/awesome). 8 | 9 | # Contents 10 | 11 | - [Awesome Honeypots ](#awesome-honeypots-) 12 | - [Contents](#contents) 13 | - [Related Lists](#related-lists) 14 | - [Honeypots](#honeypots) 15 | - [Honeyd Tools](#honeyd-tools) 16 | - [Network and Artifact Analysis](#network-and-artifact-analysis) 17 | - [Data Tools](#data-tools) 18 | - [Guides](#guides) 19 | 20 | ## Related Lists 21 | 22 | - [awesome-pcaptools](https://github.com/caesar0301/awesome-pcaptools) - Useful in network traffic analysis. 23 | - [awesome-malware-analysis](https://github.com/rshipp/awesome-malware-analysis) - Some overlap here for artifact analysis. 24 | 25 | ## Honeypots 26 | 27 | - Database Honeypots 28 | 29 | - [Delilah](https://github.com/SecurityTW/delilah) - Elasticsearch Honeypot written in Python (originally from Novetta). 30 | - [ESPot](https://github.com/mycert/ESPot) - Elasticsearch honeypot written in NodeJS, to capture every attempts to exploit CVE-2014-3120. 31 | - [ElasticPot](https://gitlab.com/bontchev/elasticpot) - An Elasticsearch Honeypot. 32 | - [Elastic honey](https://github.com/jordan-wright/elastichoney) - Simple Elasticsearch Honeypot. 33 | - [MongoDB-HoneyProxy](https://github.com/Plazmaz/MongoDB-HoneyProxy) - MongoDB honeypot proxy. 34 | - [NoSQLpot](https://github.com/torque59/nosqlpot) - Honeypot framework built on a NoSQL-style database. 35 | - [mysql-honeypotd](https://github.com/sjinks/mysql-honeypotd) - Low interaction MySQL honeypot written in C. 36 | - [MysqlPot](https://github.com/schmalle/MysqlPot) - MySQL honeypot, still very early stage. 37 | - [pghoney](https://github.com/betheroot/pghoney) - Low-interaction Postgres Honeypot. 38 | - [sticky_elephant](https://github.com/betheroot/sticky_elephant) - Medium interaction postgresql honeypot. 39 | - [RedisHoneyPot](https://github.com/cypwnpwnsocute/RedisHoneyPot) - High Interaction Honeypot Solution for Redis protocol. 40 | 41 | - Web honeypots 42 | 43 | - [Cloud Active Defense](https://github.com/SAP/cloud-active-defense?tab=readme-ov-file) - Cloud active defense lets you deploy decoys right into your cloud applications, putting adversaries into a dilemma: to hack or not to hack? 44 | - [Express honeypot](https://github.com/christophe77/express-honeypot) - RFI & LFI honeypot using nodeJS and express. 45 | - [EoHoneypotBundle](https://github.com/eymengunay/EoHoneypotBundle) - Honeypot type for Symfony2 forms. 46 | - [Glastopf](https://github.com/mushorg/glastopf) - Web Application Honeypot. 47 | - [Google Hack Honeypot](http://ghh.sourceforge.net) - Designed to provide reconnaissance against attackers that use search engines as a hacking tool against your resources. 48 | - [HellPot](https://github.com/yunginnanet/HellPot) - Honeypot that tries to crash the bots and clients that visit it's location. 49 | - [Laravel Application Honeypot](https://github.com/msurguy/Honeypot) - Simple spam prevention package for Laravel applications. 50 | - [Lophiid](https://github.com/mrheinen/lophiid/) - Distributed web application honeypot to interact with large scale exploitation attempts. 51 | - [Nodepot](https://github.com/schmalle/Nodepot) - NodeJS web application honeypot. 52 | - [PasitheaHoneypot](https://github.com/Marist-Innovation-Lab/PasitheaHoneypot) - RestAPI honeypot. 53 | - [Servletpot](https://github.com/schmalle/servletpot) - Web application Honeypot. 54 | - [Shadow Daemon](https://shadowd.zecure.org/overview/introduction/) - Modular Web Application Firewall / High-Interaction Honeypot for PHP, Perl, and Python apps. 55 | - [StrutsHoneypot](https://github.com/Cymmetria/StrutsHoneypot) - Struts Apache 2 based honeypot as well as a detection module for Apache 2 servers. 56 | - [WebTrap](https://github.com/IllusiveNetworks-Labs/WebTrap) - Designed to create deceptive webpages to deceive and redirect attackers away from real websites. 57 | - [basic-auth-pot (bap)](https://github.com/bjeborn/basic-auth-pot) - HTTP Basic Authentication honeypot. 58 | - [bwpot](https://github.com/graneed/bwpot) - Breakable Web applications honeyPot. 59 | - [django-admin-honeypot](https://github.com/dmpayton/django-admin-honeypot) - Fake Django admin login screen to notify admins of attempted unauthorized access. 60 | - [drupo](https://github.com/d1str0/drupot) - Drupal Honeypot. 61 | - [galah](https://github.com/0x4D31/galah) - an LLM-powered web honeypot using the OpenAI API. 62 | - [honeyhttpd](https://github.com/bocajspear1/honeyhttpd) - Python-based web server honeypot builder. 63 | - [honeyup](https://github.com/LogoiLab/honeyup) - An uploader honeypot designed to look like poor website security. 64 | - [modpot](https://github.com/referefref/modpot) - Modpot is a modular web application honeypot framework and management application written in Golang and making use of gin framework. 65 | - [owa-honeypot](https://github.com/joda32/owa-honeypot) - A basic flask based Outlook Web Honey pot. 66 | - [phpmyadmin_honeypot](https://github.com/gfoss/phpmyadmin_honeypot) - Simple and effective phpMyAdmin honeypot. 67 | - [shockpot](https://github.com/threatstream/shockpot) - WebApp Honeypot for detecting Shell Shock exploit attempts. 68 | - [smart-honeypot](https://github.com/freak3dot/smart-honeypot) - PHP Script demonstrating a smart honey pot. 69 | - Snare/Tanner - successors to Glastopf 70 | - [Snare](https://github.com/mushorg/snare) - Super Next generation Advanced Reactive honeypot. 71 | - [Tanner](https://github.com/mushorg/tanner) - Evaluating SNARE events. 72 | - [stack-honeypot](https://github.com/CHH/stack-honeypot) - Inserts a trap for spam bots into responses. 73 | - [tomcat-manager-honeypot](https://github.com/helospark/tomcat-manager-honeypot) - Honeypot that mimics Tomcat manager endpoints. Logs requests and saves attacker's WAR file for later study. 74 | - WordPress honeypots 75 | - [HonnyPotter](https://github.com/MartinIngesen/HonnyPotter) - WordPress login honeypot for collection and analysis of failed login attempts. 76 | - [HoneyPress](https://github.com/kungfuguapo/HoneyPress) - Python based WordPress honeypot in a Docker container. 77 | - [wp-smart-honeypot](https://github.com/freak3dot/wp-smart-honeypot) - WordPress plugin to reduce comment spam with a smarter honeypot. 78 | - [wordpot](https://github.com/gbrindisi/wordpot) - WordPress Honeypot. 79 | - [Python-Honeypot](https://github.com/OWASP/Python-Honeypot) - OWASP Honeypot, Automated Deception Framework. 80 | 81 | - Service Honeypots 82 | - [ADBHoney](https://github.com/huuck/ADBHoney) - Low interaction honeypot that simulates an Android device running Android Debug Bridge (ADB) server process. 83 | - [AMTHoneypot](https://github.com/packetflare/amthoneypot) - Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689. 84 | - [ddospot](https://github.com/aelth/ddospot) - NTP, DNS, SSDP, Chargen and generic UDP-based amplification DDoS honeypot. 85 | - [dionaea](https://github.com/DinoTools/dionaea) - Home of the dionaea honeypot. 86 | - [dhp](https://github.com/ciscocsirt/dhp) - Simple Docker Honeypot server emulating small snippets of the Docker HTTP API. 87 | - [DolosHoneypot](https://github.com/Marist-Innovation-Lab/DolosHoneypot) - SDN (software defined networking) honeypot. 88 | - [Ensnare](https://github.com/ahoernecke/ensnare) - Easy to deploy Ruby honeypot. 89 | - [GenAIPot](https://github.com/ls1911/GenAIPot) - The first A.I based open source honeypot. supports POP3 and SMTP protocols and generates content using A.I based on user description. 90 | - [Helix](https://github.com/Zeerg/helix-honeypot) - K8s API Honeypot with Active Defense Capabilities. 91 | - [honeycomb_plugins](https://github.com/Cymmetria/honeycomb_plugins) - Plugin repository for Honeycomb, the honeypot framework by Cymmetria. 92 | - [honeydb] (https://honeydb.io/downloads) - Multi-service honeypot that is easy to deploy and configure. Can be configured to send interaction data to to HoneyDB's centralized collectors for access via REST API. 93 | - [honeyntp](https://github.com/fygrave/honeyntp) - NTP logger/honeypot. 94 | - [honeypot-camera](https://github.com/alexbredo/honeypot-camera) - Observation camera honeypot. 95 | - [honeypot-ftp](https://github.com/alexbredo/honeypot-ftp) - FTP Honeypot. 96 | - [honeypots](https://github.com/qeeqbox/honeypots) - 25 different honeypots in a single pypi package! (dns, ftp, httpproxy, http, https, imap, mysql, pop3, postgres, redis, smb, smtp, socks5, ssh, telnet, vnc, mssql, elastic, ldap, ntp, memcache, snmp, oracle, sip and irc). 97 | - [honeytrap](https://github.com/honeytrap/honeytrap) - Advanced Honeypot framework written in Go that can be connected with other honeypot software. 98 | - [HoneyPy](https://github.com/foospidy/HoneyPy) - Low interaction honeypot. 99 | - [Honeygrove](https://github.com/UHH-ISS/honeygrove) - Multi-purpose modular honeypot based on Twisted. 100 | - [Honeyport](https://github.com/securitygeneration/Honeyport) - Simple honeyport written in Bash and Python. 101 | - [Honeyprint](https://github.com/glaslos/honeyprint) - Printer honeypot. 102 | - [Lyrebird](https://hub.docker.com/r/lyrebird/honeypot-base/) - Modern high-interaction honeypot framework. 103 | - [MICROS honeypot](https://github.com/Cymmetria/micros_honeypot) - Low interaction honeypot to detect CVE-2018-2636 in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (MICROS). 104 | - [node-ftp-honeypot](https://github.com/christophe77/node-ftp-honeypot) - FTP server honeypot in JS. 105 | - [pyrdp](https://github.com/gosecure/pyrdp) - RDP man-in-the-middle and library for Python 3 with the ability to watch connections live or after the fact. 106 | - [rdppot](https://github.com/kryptoslogic/rdppot) - RDP honeypot 107 | - [RDPy](https://github.com/citronneur/rdpy) - Microsoft Remote Desktop Protocol (RDP) honeypot implemented in Python. 108 | - [SMB Honeypot](https://github.com/r0hi7/HoneySMB) - High interaction SMB service honeypot capable of capturing wannacry-like Malware. 109 | - [Tom's Honeypot](https://github.com/inguardians/toms_honeypot) - Low interaction Python honeypot. 110 | - [Trapster Commmunity](https://github.com/0xBallpoint/trapster-community) - Modural and easy to install Python Honeypot, with comprehensive alerting 111 | - [troje](https://github.com/dutchcoders/troje/) - Honeypot that runs each connection with the service within a separate LXC container. 112 | - [WebLogic honeypot](https://github.com/Cymmetria/weblogic_honeypot) - Low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware. 113 | - [WhiteFace Honeypot](https://github.com/csirtgadgets/csirtg-honeypot) - Twisted based honeypot for WhiteFace. 114 | 115 | - Distributed Honeypots 116 | 117 | - [DemonHunter](https://github.com/RevengeComing/DemonHunter) - Low interaction honeypot server. 118 | 119 | - Anti-honeypot stuff 120 | 121 | - [canarytokendetector](https://github.com/referefref/canarytokendetector) - Tool for detection and nullification of Thinkst CanaryTokens 122 | - [honeydet](https://github.com/referefref/honeydet) - Signature based honeypot detector tool written in Golang 123 | - [kippo_detect](https://github.com/andrew-morris/kippo_detect) - Offensive component that detects the presence of the kippo honeypot. 124 | 125 | - ICS/SCADA honeypots 126 | 127 | - [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA honeypot. 128 | - [GasPot](https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, common in the oil and gas industry. 129 | - [SCADA honeynet](http://scadahoneynet.sourceforge.net) - Building Honeypots for Industrial Networks. 130 | - [gridpot](https://github.com/sk4ld/gridpot) - Open source tools for realistic-behaving electric grid honeynets. 131 | - [scada-honeynet](http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/) - Mimics many of the services from a popular PLC and better helps SCADA researchers understand potential risks of exposed control system devices. 132 | 133 | - Other/random 134 | 135 | - [CitrixHoneypot](https://github.com/MalwareTech/CitrixHoneypot) - Detect and log CVE-2019-19781 scan and exploitation attempts. 136 | - [Damn Simple Honeypot (DSHP)](https://github.com/naorlivne/dshp) - Honeypot framework with pluggable handlers. 137 | - [dicompot](https://github.com/nsmfoo/dicompot) - DICOM Honeypot. 138 | - [IPP Honey](https://gitlab.com/bontchev/ipphoney) - A honeypot for the Internet Printing Protocol. 139 | - [Log4Pot](https://github.com/thomaspatzke/Log4Pot) - A honeypot for the Log4Shell vulnerability (CVE-2021-44228). 140 | - [Masscanned](https://github.com/ivre/masscanned) - Let's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise. 141 | - [medpot](https://github.com/schmalle/medpot) - HL7 / FHIR honeypot. 142 | - [NOVA](https://github.com/DataSoft/Nova) - Uses honeypots as detectors, looks like a complete system. 143 | - [OpenFlow Honeypot (OFPot)](https://github.com/upa/ofpot) - Redirects traffic for unused IPs to a honeypot, built on POX. 144 | - [OpenCanary](https://github.com/thinkst/opencanary) - Modular and decentralised honeypot daemon that runs several canary versions of services that alerts when a service is (ab)used. 145 | - [ciscoasa_honeypot](https://github.com/cymmetria/ciscoasa_honeypot) A low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability. 146 | - [miniprint](https://github.com/sa7mon/miniprint) - A medium interaction printer honeypot. 147 | 148 | - Botnet C2 tools 149 | 150 | - [Hale](https://github.com/pjlantz/Hale) - Botnet command and control monitor. 151 | - [dnsMole](https://code.google.com/archive/p/dns-mole/) - Analyses DNS traffic and potentionaly detect botnet command and control server activity, along with infected hosts. 152 | 153 | - IPv6 attack detection tool 154 | 155 | - [ipv6-attack-detector](https://github.com/mzweilin/ipv6-attack-detector/) - Google Summer of Code 2012 project, supported by The Honeynet Project organization. 156 | 157 | - Dynamic code instrumentation toolkit 158 | 159 | - [Frida](https://www.frida.re) - Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android. 160 | 161 | - Tool to convert website to server honeypots 162 | 163 | - [HIHAT](http://hihat.sourceforge.net/) - Transform arbitrary PHP applications into web-based high-interaction Honeypots. 164 | 165 | - Malware collector 166 | 167 | - [Kippo-Malware](https://bruteforcelab.com/kippo-malware) - Python script that will download all malicious files stored as URLs in a Kippo SSH honeypot database. 168 | 169 | - Distributed sensor deployment 170 | 171 | - [Community Honey Network](https://communityhoneynetwork.readthedocs.io/en/stable/) - CHN aims to make deployments honeypots and honeypot management tools easy and flexible. The default deployment method uses Docker Compose and Docker to deploy with a few simple commands. 172 | - [Modern Honey Network](https://github.com/threatstream/mhn) - Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management. 173 | 174 | - Network Analysis Tool 175 | 176 | - [Tracexploit](https://code.google.com/archive/p/tracexploit/) - Replay network packets. 177 | 178 | - Log anonymizer 179 | 180 | - [LogAnon](http://code.google.com/archive/p/loganon/) - Log anonymization library that helps having anonymous logs consistent between logs and network captures. 181 | 182 | - Low interaction honeypot (router back door) 183 | 184 | - [Honeypot-32764](https://github.com/knalli/honeypot-for-tcp-32764) - Honeypot for router backdoor (TCP 32764). 185 | - [WAPot](https://github.com/lcashdol/WAPot) - Honeypot that can be used to observe traffic directed at home routers. 186 | 187 | - honeynet farm traffic redirector 188 | 189 | - [Honeymole](https://web.archive.org/web/20100326040550/http://www.honeynet.org.pt:80/index.php/HoneyMole) - Deploy multiple sensors that redirect traffic to a centralized collection of honeypots. 190 | 191 | - HTTPS Proxy 192 | 193 | - [mitmproxy](https://mitmproxy.org/) - Allows traffic flows to be intercepted, inspected, modified, and replayed. 194 | 195 | - System instrumentation 196 | 197 | - [Sysdig](https://sysdig.com/opensource/) - Open source, system-level exploration allows one to capture system state and activity from a running GNU/Linux instance, then save, filter, and analyze the results. 198 | - [Fibratus](https://github.com/rabbitstack/fibratus) - Tool for exploration and tracing of the Windows kernel. 199 | 200 | - Honeypot for USB-spreading malware 201 | 202 | - [Ghost-usb](https://github.com/honeynet/ghost-usb-honeypot) - Honeypot for malware that propagates via USB storage devices. 203 | 204 | - Data Collection 205 | 206 | - [Kippo2MySQL](https://bruteforcelab.com/kippo2mysql) - Extracts some very basic stats from Kippo’s text-based log files and inserts them in a MySQL database. 207 | - [Kippo2ElasticSearch](https://bruteforcelab.com/kippo2elasticsearch) - Python script to transfer data from a Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster). 208 | 209 | - Passive network audit framework parser 210 | 211 | - [Passive Network Audit Framework (pnaf)](https://github.com/jusafing/pnaf) - Framework that combines multiple passive and automated analysis techniques in order to provide a security assessment of network platforms. 212 | 213 | - VM monitoring and tools 214 | 215 | - [Antivmdetect](https://github.com/nsmfoo/antivmdetection) - Script to create templates to use with VirtualBox to make VM detection harder. 216 | - [VMCloak](https://github.com/hatching/vmcloak) - Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox. 217 | - [vmitools](http://libvmi.com/) - C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine. 218 | 219 | - Binary debugger 220 | 221 | - [Hexgolems - Pint Debugger Backend](https://github.com/hexgolems/pint) - Debugger backend and LUA wrapper for PIN. 222 | - [Hexgolems - Schem Debugger Frontend](https://github.com/hexgolems/schem) - Debugger frontend. 223 | 224 | - Mobile Analysis Tool 225 | 226 | - [Androguard](https://github.com/androguard/androguard) - Reverse engineering, Malware and goodware analysis of Android applications and more. 227 | - [APKinspector](https://github.com/honeynet/apkinspector/) - Powerful GUI tool for analysts to analyze the Android applications. 228 | 229 | - Low interaction honeypot 230 | 231 | - [Honeyperl](https://sourceforge.net/projects/honeyperl/) - Honeypot software based in Perl with plugins developed for many functions like : wingates, telnet, squid, smtp, etc. 232 | - [T-Pot](https://github.com/dtag-dev-sec/tpotce) - All in one honeypot appliance from telecom provider T-Mobile 233 | - [beelzebub](https://github.com/mariocandela/beelzebub) - A secure honeypot framework, extremely easy to configure by yaml 🚀 234 | 235 | - Honeynet data fusion 236 | 237 | - [HFlow2](https://projects.honeynet.org/hflow) - Data coalesing tool for honeynet/network analysis. 238 | 239 | - Server 240 | 241 | - [Amun](http://amunhoney.sourceforge.net) - Vulnerability emulation honeypot. 242 | - [Artillery](https://github.com/trustedsec/artillery/) - Open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods. 243 | - [Bait and Switch](http://baitnswitch.sourceforge.net) - Redirects all hostile traffic to a honeypot that is partially mirroring your production system. 244 | - [Bifrozt](https://github.com/Ziemeck/bifrozt-ansible) - Automatic deploy bifrozt with ansible. 245 | - [Conpot](http://conpot.org/) - Low interactive server side Industrial Control Systems honeypot. 246 | - [Heralding](https://github.com/johnnykv/heralding) - Credentials catching honeypot. 247 | - [HoneyWRT](https://github.com/CanadianJeff/honeywrt) - Low interaction Python honeypot designed to mimic services or ports that might get targeted by attackers. 248 | - [Honeyd](https://github.com/provos/honeyd) - See [honeyd tools](#honeyd-tools). 249 | - [Honeysink](http://www.honeynet.org/node/773) - Open source network sinkhole that provides a mechanism for detection and prevention of malicious traffic on a given network. 250 | - [Hontel](https://github.com/stamparm/hontel) - Telnet Honeypot. 251 | - [KFSensor](http://www.keyfocus.net/kfsensor/) - Windows based honeypot Intrusion Detection System (IDS). 252 | - [LaBrea](http://labrea.sourceforge.net/labrea-info.html) - Takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet. 253 | - [MTPot](https://github.com/Cymmetria/MTPot) - Open Source Telnet Honeypot, focused on Mirai malware. 254 | - [SIREN](https://github.com/blaverick62/SIREN) - Semi-Intelligent HoneyPot Network - HoneyNet Intelligent Virtual Environment. 255 | - [TelnetHoney](https://github.com/balte/TelnetHoney) - Simple telnet honeypot. 256 | - [UDPot Honeypot](https://github.com/jekil/UDPot) - Simple UDP/DNS honeypot scripts. 257 | - [Yet Another Fake Honeypot (YAFH)](https://github.com/fnzv/YAFH) - Simple honeypot written in Go. 258 | - [arctic-swallow](https://github.com/ajackal/arctic-swallow) - Low interaction honeypot. 259 | - [fapro](https://github.com/fofapro/fapro) - Fake Protocol Server. 260 | - [glutton](https://github.com/mushorg/glutton) - All eating honeypot. 261 | - [go-HoneyPot](https://github.com/Mojachieee/go-HoneyPot) - Honeypot server written in Go. 262 | - [go-emulators](https://github.com/kingtuna/go-emulators) - Honeypot Golang emulators. 263 | - [honeymail](https://github.com/sec51/honeymail) - SMTP honeypot written in Golang. 264 | - [honeytrap](https://github.com/tillmannw/honeytrap) - Low-interaction honeypot and network security tool written to catch attacks against TCP and UDP services. 265 | - [imap-honey](https://github.com/yvesago/imap-honey) - IMAP honeypot written in Golang. 266 | - [mwcollectd](https://www.openhub.net/p/mwcollectd) - Versatile malware collection daemon, uniting the best features of nepenthes and honeytrap. 267 | - [potd](https://github.com/lnslbrty/potd) - Highly scalable low- to medium-interaction SSH/TCP honeypot designed for OpenWrt/IoT devices leveraging several Linux kernel features, such as namespaces, seccomp and thread capabilities. 268 | - [portlurker](https://github.com/bartnv/portlurker) - Port listener in Rust with protocol guessing and safe string display. 269 | - [slipm-honeypot](https://github.com/rshipp/slipm-honeypot) - Simple low-interaction port monitoring honeypot. 270 | - [telnet-iot-honeypot](https://github.com/Phype/telnet-iot-honeypot) - Python telnet honeypot for catching botnet binaries. 271 | - [telnetlogger](https://github.com/robertdavidgraham/telnetlogger) - Telnet honeypot designed to track the Mirai botnet. 272 | - [vnclowpot](https://github.com/magisterquis/vnclowpot) - Low interaction VNC honeypot. 273 | 274 | - IDS signature generation 275 | 276 | - [Honeycomb](http://www.icir.org/christian/honeycomb/) - Automated signature creation using honeypots. 277 | 278 | - Lookup service for AS-numbers and prefixes 279 | 280 | - [CC2ASN](http://www.cc2asn.com/) - Simple lookup service for AS-numbers and prefixes belonging to any given country in the world. 281 | 282 | - Data Collection / Data Sharing 283 | 284 | - [HPfriends](http://hpfriends.honeycloud.net/#/home) - Honeypot data-sharing platform. 285 | - [hpfriends - real-time social data-sharing](https://heipei.io/sigint-hpfriends/) - Presentation about HPFriends feed system 286 | - [HPFeeds](https://github.com/rep/hpfeeds/) - Lightweight authenticated publish-subscribe protocol. 287 | 288 | - Central management tool 289 | 290 | - [PHARM](http://www.nepenthespharm.com/) - Manage, report, and analyze your distributed Nepenthes instances. 291 | 292 | - Network connection analyzer 293 | 294 | - [Impost](http://impost.sourceforge.net/) - Network security auditing tool designed to analyze the forensics behind compromised and/or vulnerable daemons. 295 | 296 | - Honeypot deployment 297 | 298 | - [honeyfs](https://github.com/referefref/honeyfs) - Tool to create artificial file systems for medium/high interaction honeypots. 299 | - [Modern Honeynet Network](http://threatstream.github.io/mhn/) - Streamlines deployment and management of secure honeypots. 300 | 301 | - Honeypot extensions to Wireshark 302 | 303 | - [Wireshark Extensions](https://www.honeynet.org/project/WiresharkExtensions) - Apply Snort IDS rules and signatures against packet capture files using Wireshark. 304 | 305 | - Client 306 | 307 | - [CWSandbox / GFI Sandbox](https://www.gfi.com/products-and-solutions/all-products) 308 | - [Capture-HPC-Linux](https://redmine.honeynet.org/projects/linux-capture-hpc/wiki) 309 | - [Capture-HPC-NG](https://github.com/CERT-Polska/HSN-Capture-HPC-NG) 310 | - [Capture-HPC](https://projects.honeynet.org/capture-hpc) - High interaction client honeypot (also called honeyclient). 311 | - [HoneyBOT](http://www.atomicsoftwaresolutions.com/) 312 | - [HoneyC](https://projects.honeynet.org/honeyc) 313 | - [HoneySpider Network](https://github.com/CERT-Polska/hsn2-bundle) - Highly-scalable system integrating multiple client honeypots to detect malicious websites. 314 | - [HoneyWeb](https://code.google.com/archive/p/gsoc-honeyweb/) - Web interface created to manage and remotely share Honeyclients resources. 315 | - [Jsunpack-n](https://github.com/urule99/jsunpack-n) 316 | - [MonkeySpider](http://monkeyspider.sourceforge.net) 317 | - [PhoneyC](https://github.com/honeynet/phoneyc) - Python honeyclient (later replaced by Thug). 318 | - [Pwnypot](https://github.com/shjalayeri/pwnypot) - High Interaction Client Honeypot. 319 | - [Rumal](https://github.com/thugs-rumal/) - Thug's Rumāl: a Thug's dress and weapon. 320 | - [Shelia](https://www.cs.vu.nl/~herbertb/misc/shelia/) - Client-side honeypot for attack detection. 321 | - [Thug](https://buffer.github.io/thug/) - Python-based low-interaction honeyclient. 322 | - [Thug Distributed Task Queuing](https://thug-distributed.readthedocs.io/en/latest/index.html) 323 | - [Trigona](https://www.honeynet.org/project/Trigona) 324 | - [URLQuery](https://urlquery.net/) 325 | - [YALIH (Yet Another Low Interaction Honeyclient)](https://github.com/Masood-M/yalih) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques. 326 | 327 | - Honeypot 328 | 329 | - [Deception Toolkit](http://www.all.net/dtk/dtk.html) 330 | - [IMHoneypot](https://github.com/mushorg/imhoneypot) 331 | 332 | - PDF document inspector 333 | 334 | - [peepdf](https://github.com/jesparza/peepdf) - Powerful Python tool to analyze PDF documents. 335 | 336 | - Hybrid low/high interaction honeypot 337 | 338 | - [HoneyBrid](http://honeybrid.sourceforge.net) 339 | 340 | - SSH Honeypots 341 | 342 | - [Blacknet](https://github.com/morian/blacknet) - Multi-head SSH honeypot system. 343 | - [Cowrie](https://github.com/cowrie/cowrie) - Cowrie SSH Honeypot (based on kippo). 344 | - [DShield docker](https://github.com/xme/dshield-docker) - Docker container running cowrie with DShield output enabled. 345 | - [endlessh](https://github.com/skeeto/endlessh) - SSH tarpit that slowly sends an endless banner. ([docker image](https://hub.docker.com/r/linuxserver/endlessh)) 346 | - [HonSSH](https://github.com/tnich/honssh) - Logs all SSH communications between a client and server. 347 | - [HUDINX](https://github.com/Cryptix720/HUDINX) - Tiny interaction SSH honeypot engineered in Python to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker. 348 | - [Kippo](https://github.com/desaster/kippo) - Medium interaction SSH honeypot. 349 | - [Kippo_JunOS](https://github.com/gregcmartin/Kippo_JunOS) - Kippo configured to be a backdoored netscreen. 350 | - [Kojoney2](https://github.com/madirish/kojoney2) - Low interaction SSH honeypot written in Python and based on Kojoney by Jose Antonio Coret. 351 | - [Kojoney](http://kojoney.sourceforge.net/) - Python-based Low interaction honeypot that emulates an SSH server implemented with Twisted Conch. 352 | - [Longitudinal Analysis of SSH Cowrie Honeypot Logs](https://github.com/deroux/longitudinal-analysis-cowrie) - Python based command line tool to analyze cowrie logs over time. 353 | - [LongTail Log Analysis @ Marist College](http://longtail.it.marist.edu/honey/) - Analyzed SSH honeypot logs. 354 | - [Malbait](https://github.com/batchmcnulty/Malbait) - Simple TCP/UDP honeypot implemented in Perl. 355 | - [MockSSH](https://github.com/ncouture/MockSSH) - Mock an SSH server and define all commands it supports (Python, Twisted). 356 | - [cowrie2neo](https://github.com/xlfe/cowrie2neo) - Parse cowrie honeypot logs into a neo4j database. 357 | - [go-sshoney](https://github.com/ashmckenzie/go-sshoney) - SSH Honeypot. 358 | - [go0r](https://github.com/fzerorubigd/go0r) - Simple ssh honeypot in Golang. 359 | - [gohoney](https://github.com/PaulMaddox/gohoney) - SSH honeypot written in Go. 360 | - [hived](https://github.com/sahilm/hived) - Golang-based honeypot. 361 | - [hnypots-agent)](https://github.com/joshrendek/hnypots-agent) - SSH Server in Go that logs username and password combinations. 362 | - [honeypot.go](https://github.com/mdp/honeypot.go) - SSH Honeypot written in Go. 363 | - [honeyssh](https://github.com/ppacher/honeyssh) - Credential dumping SSH honeypot with statistics. 364 | - [hornet](https://github.com/czardoz/hornet) - Medium interaction SSH honeypot that supports multiple virtual hosts. 365 | - [ssh-auth-logger](https://github.com/JustinAzoff/ssh-auth-logger) - Low/zero interaction SSH authentication logging honeypot. 366 | - [ssh-honeypot](https://github.com/droberson/ssh-honeypot) - Fake sshd that logs IP addresses, usernames, and passwords. 367 | - [ssh-honeypot](https://github.com/amv42/sshd-honeypot) - Modified version of the OpenSSH deamon that forwards commands to Cowrie where all commands are interpreted and returned. 368 | - [ssh-honeypotd](https://github.com/sjinks/ssh-honeypotd) - Low-interaction SSH honeypot written in C. 369 | - [sshForShits](https://github.com/traetox/sshForShits) - Framework for a high interaction SSH honeypot. 370 | - [sshesame](https://github.com/jaksi/sshesame) - Fake SSH server that lets everyone in and logs their activity. 371 | - [sshhipot](https://github.com/magisterquis/sshhipot) - High-interaction MitM SSH honeypot. 372 | - [sshlowpot](https://github.com/magisterquis/sshlowpot) - Yet another no-frills low-interaction SSH honeypot in Go. 373 | - [sshsyrup](https://github.com/mkishere/sshsyrup) - Simple SSH Honeypot with features to capture terminal activity and upload to asciinema.org. 374 | - [twisted-honeypots](https://github.com/lanjelot/twisted-honeypots) - SSH, FTP and Telnet honeypots based on Twisted. 375 | 376 | - Distributed sensor project 377 | 378 | - [DShield Web Honeypot Project](https://sites.google.com/site/webhoneypotsite/) 379 | 380 | - A pcap analyzer 381 | 382 | - [Honeysnap](https://projects.honeynet.org/honeysnap/) 383 | 384 | - Network traffic redirector 385 | 386 | - [Honeywall](https://projects.honeynet.org/honeywall/) 387 | 388 | - Honeypot Distribution with mixed content 389 | 390 | - [HoneyDrive](https://bruteforcelab.com/honeydrive) 391 | 392 | - Honeypot sensor 393 | 394 | - [Honeeepi](https://redmine.honeynet.org/projects/honeeepi/wiki) - Honeypot sensor on a Raspberry Pi based on a customized Raspbian OS. 395 | 396 | - File carving 397 | 398 | - [TestDisk & PhotoRec](https://www.cgsecurity.org/) 399 | 400 | - Behavioral analysis tool for win32 401 | 402 | - [Capture BAT](https://www.honeynet.org/node/315) 403 | 404 | - Live CD 405 | 406 | - [DAVIX](https://www.secviz.org/node/89) - The DAVIX Live CD. 407 | 408 | - Spamtrap 409 | 410 | - [Mail::SMTP::Honeypot](https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - Perl module that appears to provide the functionality of a standard SMTP server. 411 | - [Mailoney](https://github.com/phin3has/mailoney) - SMTP honeypot written in python. 412 | - [SendMeSpamIDS.py](https://github.com/johestephan/VerySimpleHoneypot) - Simple SMTP fetch all IDS and analyzer. 413 | - [Shiva](https://github.com/shiva-spampot/shiva) - Spam Honeypot with Intelligent Virtual Analyzer. 414 | - [Shiva The Spam Honeypot Tips And Tricks For Getting It Up And Running](https://www.pentestpartners.com/security-blog/shiva-the-spam-honeypot-tips-and-tricks-for-getting-it-up-and-running/) 415 | - [SMTPLLMPot](https://github.com/referefref/SMTPLLMPot) - A super simple SMTP Honeypot built using GPT3.5 416 | - [SpamHAT](https://github.com/miguelraulb/spamhat) - Spam Honeypot Tool. 417 | - [Spamhole](http://www.spamhole.net/) 418 | - [honeypot](https://github.com/jadb/honeypot) - The Project Honey Pot un-official PHP SDK. 419 | - [spamd](http://man.openbsd.org/cgi-bin/man.cgi?query=spamd%26apropos=0%26sektion=0%26manpath=OpenBSD+Current%26arch=i386%26format=html) 420 | 421 | - Commercial honeynet 422 | 423 | - [Cymmetria Mazerunner](ttps://cymmetria.com/products/mazerunner/) - Leads attackers away from real targets and creates a footprint of the attack. 424 | 425 | - Server (Bluetooth) 426 | 427 | - [Bluepot](https://github.com/andrewmichaelsmith/bluepot) 428 | 429 | - Dynamic analysis of Android apps 430 | 431 | - [Droidbox](https://code.google.com/archive/p/droidbox/) 432 | 433 | - Dockerized Low Interaction packaging 434 | 435 | - [Docker honeynet](https://github.com/sreinhardt/Docker-Honeynet) - Several Honeynet tools set up for Docker containers. 436 | - [Dockerized Thug](https://hub.docker.com/r/honeynet/thug/) - Dockerized [Thug](https://github.com/buffer/thug) to analyze malicious web content. 437 | - [Dockerpot](https://github.com/mrschyte/dockerpot) - Docker based honeypot. 438 | - [Manuka](https://github.com/andrewmichaelsmith/manuka) - Docker based honeypot (Dionaea and Kippo). 439 | - [honey_ports](https://github.com/run41/honey_ports) - Very simple but effective docker deployed honeypot to detect port scanning in your environment. 440 | - [mhn-core-docker](https://github.com/MattCarothers/mhn-core-docker) - Core elements of the Modern Honey Network implemented in Docker. 441 | 442 | - Network analysis 443 | 444 | - [Quechua](https://bitbucket.org/zaccone/quechua) 445 | 446 | - SIP Server 447 | 448 | - [Artemnesia VoIP](http://artemisa.sourceforge.net) 449 | 450 | - SIP 451 | 452 | - [SentryPeer](https://github.com/SentryPeer/SentryPeer) - Protect your SIP Servers from bad actors. 453 | 454 | - IOT Honeypot 455 | 456 | - [HoneyThing](https://github.com/omererdem/honeything) - TR-069 Honeypot. 457 | - [Kako](https://github.com/darkarnium/kako) - Honeypots for a number of well known and deployed embedded device vulnerabilities. 458 | 459 | - Honeytokens 460 | - [CanaryTokens](https://github.com/thinkst/canarytokens) - Self-hostable honeytoken generator and reporting dashboard; demo version available at [CanaryTokens.org](https://canarytokens.org/generate). 461 | - [Honeybits](https://github.com/0x4D31/honeybits) - Simple tool designed to enhance the effectiveness of your traps by spreading breadcrumbs and honeytokens across your production servers and workstations to lure the attacker toward your honeypots. 462 | - [Honeyλ (HoneyLambda)](https://github.com/0x4D31/honeylambda) - Simple, serverless application designed to create and monitor URL honeytokens, on top of AWS Lambda and Amazon API Gateway. 463 | - [dcept](https://github.com/secureworks/dcept) - Tool for deploying and detecting use of Active Directory honeytokens. 464 | - [honeyku](https://github.com/0x4D31/honeyku) - Heroku-based web honeypot that can be used to create and monitor fake HTTP endpoints (i.e. honeytokens). 465 | 466 | ## Honeyd Tools 467 | 468 | - Honeyd plugin 469 | 470 | - [Honeycomb](http://www.honeyd.org/tools.php) 471 | 472 | - Honeyd viewer 473 | 474 | - [Honeyview](http://honeyview.sourceforge.net/) 475 | 476 | - Honeyd to MySQL connector 477 | 478 | - [Honeyd2MySQL](https://bruteforcelab.com/honeyd2mysql) 479 | 480 | - A script to visualize statistics from honeyd 481 | 482 | - [Honeyd-Viz](https://bruteforcelab.com/honeyd-viz) 483 | 484 | - Honeyd stats 485 | - [Honeydsum.pl](https://github.com/DataSoft/Honeyd/blob/master/scripts/misc/honeydsum-v0.3/honeydsum.pl) 486 | 487 | ## Network and Artifact Analysis 488 | 489 | - Sandbox 490 | 491 | - [Argos](http://www.few.vu.nl/argos/) - Emulator for capturing zero-day attacks. 492 | - [COMODO automated sandbox](https://help.comodo.com/topic-72-1-451-4768-.html) 493 | - [Cuckoo](https://cuckoosandbox.org/) - Leading open source automated malware analysis system. 494 | - [Pylibemu](https://github.com/buffer/pylibemu) - Libemu Cython wrapper. 495 | - [RFISandbox](https://monkey.org/~jose/software/rfi-sandbox/) - PHP 5.x script sandbox built on top of [funcall](https://pecl.php.net/package/funcall). 496 | - [dorothy2](https://github.com/m4rco-/dorothy2) - Malware/botnet analysis framework written in Ruby. 497 | - [imalse](https://github.com/hbhzwj/imalse) - Integrated MALware Simulator and Emulator. 498 | - [libemu](https://github.com/buffer/libemu) - Shellcode emulation library, useful for shellcode detection. 499 | 500 | - Sandbox-as-a-Service 501 | 502 | - [Hybrid Analysis](https://www.hybrid-analysis.com) - Free malware analysis service powered by Payload Security that detects and analyzes unknown threats using a unique Hybrid Analysis technology. 503 | - [Joebox Cloud](https://jbxcloud.joesecurity.org/login) - Analyzes the behavior of malicious files including PEs, PDFs, DOCs, PPTs, XLSs, APKs, URLs and MachOs on Windows, Android and Mac OS X for suspicious activities. 504 | - [VirusTotal](https://www.virustotal.com/) - Analyze suspicious files and URLs to detect types of malware, and automatically share them with the security community. 505 | - [malwr.com](https://malwr.com/) - Free malware analysis service and community. 506 | 507 | ## Data Tools 508 | 509 | - Front Ends 510 | 511 | - [DionaeaFR](https://github.com/rubenespadas/DionaeaFR) - Front Web to Dionaea low-interaction honeypot. 512 | - [Django-kippo](https://github.com/jedie/django-kippo) - Django App for kippo SSH Honeypot. 513 | - [Shockpot-Frontend](https://github.com/GovCERT-CZ/Shockpot-Frontend) - Full featured script to visualize statistics from a Shockpot honeypot. 514 | - [Tango](https://github.com/aplura/Tango) - Honeypot Intelligence with Splunk. 515 | - [Wordpot-Frontend](https://github.com/GovCERT-CZ/Wordpot-Frontend) - Full featured script to visualize statistics from a Wordpot honeypot. 516 | - [honeyalarmg2](https://github.com/schmalle/honeyalarmg2) - Simplified UI for showing honeypot alarms. 517 | - [honeypotDisplay](https://github.com/Joss-Steward/honeypotDisplay) - Flask website which displays data gathered from an SSH Honeypot. 518 | 519 | - Visualization 520 | 521 | - [Acapulco](https://github.com/hgascon/acapulco) - Automated Attack Community Graph Construction. 522 | - [Afterglow Cloud](https://github.com/ayrus/afterglow-cloud) 523 | - [Afterglow](http://afterglow.sourceforge.net/) 524 | - [Glastopf Analytics](https://github.com/katkad/Glastopf-Analytics) - Easy honeypot statistics. 525 | - [HoneyMalt](https://github.com/SneakersInc/HoneyMalt) - Maltego tranforms for mapping Honeypot systems. 526 | - [HoneyMap](https://github.com/fw42/honeymap) - Real-time websocket stream of GPS events on a fancy SVG world map. 527 | - [HoneyStats](https://sourceforge.net/projects/honeystats/) - Statistical view of the recorded activity on a Honeynet. 528 | - [HpfeedsHoneyGraph](https://github.com/yuchincheng/HpfeedsHoneyGraph) - Visualization app to visualize hpfeeds logs. 529 | - [IVRE](https://github.com/ivre/ivre) - Network recon framework, published by @cea-sec & @ANSSI-FR. Build your own, self-hosted and fully-controlled alternatives to Criminalip / Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, collect and analyse network intelligence from your sensors, and much more! 530 | - [Kippo stats](https://github.com/mfontani/kippo-stats) - Mojolicious app to display statistics for your kippo SSH honeypot. 531 | - [Kippo-Graph](https://bruteforcelab.com/kippo-graph) - Full featured script to visualize statistics from a Kippo SSH honeypot. 532 | - [The Intelligent HoneyNet](https://github.com/jpyorre/IntelligentHoneyNet) - Create actionable information from honeypots. 533 | - [ovizart](https://github.com/oguzy/ovizart) - Visual analysis for network traffic. 534 | 535 | ## Guides 536 | 537 | - [T-Pot: A Multi-Honeypot Platform](https://dtag-dev-sec.github.io/mediator/feature/2015/03/17/concept.html) 538 | - [Honeypot (Dionaea and kippo) setup script](https://github.com/andrewmichaelsmith/honeypot-setup-script/) 539 | 540 | - Deployment 541 | 542 | - [Dionaea and EC2 in 20 Minutes](http://andrewmichaelsmith.com/2012/03/dionaea-honeypot-on-ec2-in-20-minutes/) - Tutorial on setting up Dionaea on an EC2 instance. 543 | - [Using a Raspberry Pi honeypot to contribute data to DShield/ISC](https://isc.sans.edu/diary/22680) - The Raspberry Pi based system will allow us to maintain one code base that will make it easier to collect rich logs beyond firewall logs. 544 | - [honeypotpi](https://github.com/free5ty1e/honeypotpi) - Script for turning a Raspberry Pi into a HoneyPot Pi. 545 | 546 | - Research Papers 547 | 548 | - [Honeypot research papers](https://github.com/shbhmsingh72/Honeypot-Research-Papers) - PDFs of research papers on honeypots. 549 | - [vEYE](https://link.springer.com/article/10.1007%2Fs10115-008-0137-3) - Behavioral footprinting for self-propagating worm detection and profiling. 550 | -------------------------------------------------------------------------------- /README_CN.md: -------------------------------------------------------------------------------- 1 | # 最优秀的蜜罐列表 [![Awesome Honeypots](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/sindresorhus/awesome) 2 | 3 | 优秀的蜜罐、组件等等相关的工具列表，分为 Web、服务等多个类别，重点放在开源项目上 4 | 5 | 每个类别中没有顺序，按照提交的先后顺序排列，如果您也想提交，请阅读 [指南](CONTRIBUTING.md). 6 | 7 | 探索更多优秀的列表请参阅：[sindresorhus/awesome](https://github.com/sindresorhus/awesome). 8 | 9 | # 目录 10 | 11 | - [最优秀的蜜罐列表 ](#最优秀的蜜罐列表-) 12 | - [目录](#目录) 13 | - [相关列表](#相关列表) 14 | - [蜜罐](#蜜罐) 15 | - [Honeyd工具](#honeyd工具) 16 | - [网络与行为分析](#网络与行为分析) 17 | - [数据分析工具](#数据分析工具) 18 | - [指南](#指南) 19 | 20 | ## 相关列表 21 | 22 | - [awesome-pcaptools](https://github.com/caesar0301/awesome-pcaptools) 网络流量分析 23 | - [awesome-malware-analysis](https://github.com/rshipp/awesome-malware-analysis) 与上表有些重复，更侧重恶意软件分析 24 | 25 | ## 蜜罐 26 | 27 | - 数据库蜜罐 28 | - [Delilah](https://github.com/SecurityTW/delilah) - Python 编写的 Elasticsearch 蜜罐 29 | - [ESPot](https://github.com/mycert/ESPot) - 一个用 NodeJS 编写的 Elasticsearch 蜜罐，用于对 CVE-2014-3120 的利用 30 | - [ElasticPot](https://gitlab.com/bontchev/elasticpot) - Elasticsearch 蜜罐 31 | - [Elastic honey](https://github.com/jordan-wright/elastichoney) - 简单的 Elasticsearch 蜜罐 32 | - [MongoDB-HoneyProxy](https://github.com/Plazmaz/MongoDB-HoneyProxy) - MongoDB 蜜罐代理 33 | - [NoSQLpot](https://github.com/torque59/nosqlpot) - NoSQL 蜜罐框架 34 | - [mysql-honeypotd](https://github.com/sjinks/mysql-honeypotd) - C 编写的低交互 MySQL 蜜罐 35 | - [MysqlPot](https://github.com/schmalle/MysqlPot) - MySQL 蜜罐 36 | - [pghoney](https://github.com/betheroot/pghoney) - 低交互 Postgres 蜜罐 37 | - [sticky_elephant](https://github.com/betheroot/sticky_elephant) - 中交互 postgresql 蜜罐 38 | - [RedisHoneyPot](https://github.com/cypwnpwnsocute/RedisHoneyPot) - 高交互 Redis 蜜罐 39 | 40 | - Web 蜜罐 41 | - [Express honeypot](https://github.com/christophe77/express-honeypot) - 使用 nodeJS 和 express 实现的 RFI & LFI 蜜罐 42 | - [EoHoneypotBundle](https://github.com/eymengunay/EoHoneypotBundle) - Symfony2 类型的蜜罐 43 | - [Glastopf](https://github.com/mushorg/glastopf) - Web 应用蜜罐 44 | - [Google Hack Honeypot](http://ghh.sourceforge.net) - 旨在提供针对那些使用搜索引擎探测资源的攻击者的侦察 45 | - [HellPot](https://github.com/yunginnanet/HellPot) - 试图让请求位置的 Bot 和客户端崩溃的蜜罐 46 | - [Laravel Application Honeypot](https://github.com/msurguy/Honeypot) - Honeypot - Laravel 应用程序的简单垃圾邮件预防软件包 47 | - [Nodepot](https://github.com/schmalle/Nodepot) - NodeJS Web 应用蜜罐 48 | - [PasitheaHoneypot](https://github.com/Marist-Innovation-Lab/PasitheaHoneypot) - RestAPI 蜜罐 49 | - [Servletpot](https://github.com/schmalle/servletpot) - Web 应用蜜罐 50 | - [Shadow Daemon](https://shadowd.zecure.org/overview/introduction/) - 用于 PHP、Perl 和 Python 应用程序的模块化Web应用程序防火墙/高交互式蜜罐 51 | - [StrutsHoneypot](https://github.com/Cymmetria/StrutsHoneypot) - 基于 Struts Apache 2 的蜜罐 52 | - [WebTrap](https://github.com/IllusiveNetworks-Labs/WebTrap) - 旨在创建欺骗性网页，重定向到真实网站 53 | - [basic-auth-pot (bap)](https://github.com/bjeborn/basic-auth-pot) bap - HTTP 基本认证蜜罐 54 | - [bwpot](https://github.com/graneed/bwpot) - Web 应用蜜罐 55 | - [django-admin-honeypot](https://github.com/dmpayton/django-admin-honeypot) - 虚假的 Django 管理登录页面，记录未经授权的访问尝试 56 | - [drupo](https://github.com/d1str0/drupot) - Drupal 蜜罐 57 | - [galah](https://github.com/0x4D31/galah) - 基于 OpneAI API 的大语言模型（LLM）驱动的蜜罐 58 | - [honeyhttpd](https://github.com/bocajspear1/honeyhttpd) - 基于 Python 的 Web 服务器蜜罐构建工具 59 | - [honeyup](https://github.com/LogoiLab/honeyup) - 模拟不安全网站的 Web 蜜罐 60 | - [modpot](https://github.com/referefref/modpot) - Modpot 是模块化的 Web 应用蜜罐框架，该框架基于 Golang 与 Gin 开发。 61 | - [owa-honeypot](https://github.com/joda32/owa-honeypot) - 基于 Flask 的 Outlook Web 蜜罐 62 | - [phpmyadmin_honeypot](https://github.com/gfoss/phpmyadmin_honeypot) - - 简单有效的 phpMyAdmin 蜜罐 63 | - [shockpot](https://github.com/threatstream/shockpot) - 检测 Shell Shock 利用尝试的 Web 应用蜜罐 64 | - [smart-honeypot](https://github.com/freak3dot/smart-honeypot) - PHP 脚本编写的智能蜜罐 65 | - Snare/Tanner - Glastopf 的后继者 66 | - [Snare](https://github.com/mushorg/snare) - 下一代高交互 honEypot 67 | - [Tanner](https://github.com/mushorg/tanner) - 评估 SNARE 事件 68 | - [stack-honeypot](https://github.com/CHH/stack-honeypot) - 将针对垃圾邮件机器人的陷阱插入到响应中 69 | - [tomcat-manager-honeypot](https://github.com/helospark/tomcat-manager-honeypot) - Tomcat 蜜罐。记录请求并保存攻击者的 WAR 文件 70 | - WordPress honeypots 71 | - [HonnyPotter](https://github.com/MartinIngesen/HonnyPotter) - WordPress 的登录蜜罐，用于收集和分析失败的登录尝试 72 | - [HoneyPress](https://github.com/kungfuguapo/HoneyPress) - Docker 容器中基于 Python 的 WordPress 蜜罐 73 | - [wp-smart-honeypot](https://github.com/freak3dot/wp-smart-honeypot) - 减少垃圾邮件的 WordPress 插件 74 | - [wordpot](https://github.com/gbrindisi/wordpot) - WordPress 蜜罐 75 | - [Python-Honeypot](https://github.com/OWASP/Python-Honeypot) - OWASP 蜜罐，自动化欺骗框架 76 | 77 | - 服务蜜罐 78 | - [ADBHoney](https://github.com/huuck/ADBHoney) - 安卓低交互蜜罐 79 | - [AMTHoneypot](https://github.com/packetflare/amthoneypot) - 针对 Intel 的 AMT 固件漏洞（CVE-2017-5689）的蜜罐 80 | - [ddospot](https://github.com/aelth/ddospot) -反射放大 DDoS 蜜罐，支持 NTP、DNS、SSDP、Chargen 与其他 UDP 协议 81 | - [dionaea](https://github.com/DinoTools/dionaea) - dionaea 蜜罐的主页 82 | - [dhp](https://github.com/ciscocsirt/dhp) - 模拟 Docker HTTP API 的简单 Docker 蜜罐 83 | - [DolosHoneypot](https://github.com/Marist-Innovation-Lab/DolosHoneypot) - SDN 蜜罐 84 | - [Ensnare](https://github.com/ahoernecke/ensnare) - 易部署的 Ruby 蜜罐 85 | - [Helix](https://github.com/Zeerg/helix-honeypot) - 具备主动防御能力的 K8s API 蜜罐 86 | - [honeycomb_plugins](https://github.com/Cymmetria/honeycomb_plugins) - Cymmetria 蜜罐 Honeycomb 插件库 87 | - [honeydb] (https://honeydb.io/downloads) - 易于部署和配置的多服务蜜罐。用户可以将交互数据回传到 HoneyDB 后端汇集在一处，以便通过 REST API 进行访问 88 | - [honeyntp](https://github.com/fygrave/honeyntp) - NTP 蜜罐 89 | - [honeypot-camera](https://github.com/alexbredo/honeypot-camera) - 摄像机蜜罐 90 | - [honeypot-ftp](https://github.com/alexbredo/honeypot-ftp) - FTP 蜜罐 91 | - [honeypots]（https://github.com/qeeqbox/honeypots） - 一个 pypi 包中有 25 种不同的蜜罐！（DNS、FTP、HTTPPROXY、HTTP、HTTPS、IMAP、MYSQL、POP3、postgres、redis、smb、smtp、socks5、ssh、telnet、vnc、mssql、elastic、ldap、ntp、memcache、snmp、oracle、sip 和 irc） 92 | - [honeytrap]（https://github.com/honeytrap/honeytrap） - 用 Go 编写的高级蜜罐框架，可以与其他蜜罐软件连接 93 | - [HoneyPy](https://github.com/foospidy/HoneyPy) - 低交互蜜罐 94 | - [Honeygrove](https://github.com/UHH-ISS/honeygrove) - 基于 Twisted 的多用途、模块化蜜罐 95 | - [Honeyport](https://github.com/securitygeneration/Honeyport) - Bash 和 Python 写成的简单 honeyport 96 | - [Honeyprint](https://github.com/glaslos/honeyprint) - 打印机蜜罐 97 | - [Lyrebird](https://hub.docker.com/r/lyrebird/honeypot-base/) - 现代高交互蜜罐框架 98 | - [MICROS honeypot](https://github.com/Cymmetria/micros_honeypot) - 在带有 Oracle Hospitality Simphony 的 Oracle Hospitality Applications (MICROS) 中检测 CVE-2018-2636 的低交互蜜罐 99 | - [node-ftp-honeypot](https://github.com/christophe77/node-ftp-honeypot) - JavaScript 编写的 FTP 蜜罐 100 | - [pyrdp](https://github.com/gosecure/pyrdp) - Python 3 实现的 RDP 蜜罐 101 | - [rdppot](https://github.com/kryptoslogic/rdppot) - RDP 蜜罐 102 | - [RDPy](https://github.com/citronneur/rdpy) - Python 实现的 RDP 蜜罐 103 | - [SMB Honeypot](https://github.com/r0hi7/HoneySMB) - 可以捕获类似 Wannacry 的恶意软件的高交互 SMB 蜜罐 104 | - [Tom's Honeypot](https://github.com/inguardians/toms_honeypot) - 低交互 Python 蜜罐 105 | - [Trapster Commmunity](https://github.com/0xBallpoint/trapster-community) - 模块化且易于安装的 Python Honeypot，具有全面的警报功能 106 | - [troje](https://github.com/dutchcoders/troje/) - 在独立的 LXC 容器中运行的蜜罐服务 107 | - [WebLogic honeypot](https://github.com/Cymmetria/weblogic_honeypot) - 在带有 Oracle WebLogic Server 的 Oracle Fusion Middleware 中检测 CVE-2017-10271 的低交互蜜罐 108 | - [WhiteFace Honeypot](https://github.com/csirtgadgets/csirtg-honeypot) - 基于 Twisted 开发的针对 WhiteFace 蜜罐 109 | 110 | - 分布式蜜罐 111 | - [DemonHunter](https://github.com/RevengeComing/DemonHunter) - 低交互蜜罐服务器 112 | 113 | - 反蜜罐 114 | - [canarytokendetector](https://github.com/referefref/canarytokendetector) - 用于检测 Thinkst CanaryTokens 的工具 115 | - [honeydet](https://github.com/referefref/honeydet) - Golang 编写的基于签名的蜜罐检测工具 116 | - [kippo_detect](https://github.com/andrew-morris/kippo_detect) - 检测 Kippo 蜜罐 117 | 118 | - ICS/SCADA 蜜罐 119 | - [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA 蜜罐 120 | - [GasPot](https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, 常见于石油、天然气行业 121 | - [SCADA honeynet](http://scadahoneynet.sourceforge.net) - 建立工业网络的蜜罐 122 | - [gridpot](https://github.com/sk4ld/gridpot) - 模拟实际电网的开源蜜罐 123 | - [scada-honeynet](http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/) - 模拟流行的 PLC 服务，更好地帮助 SCADA 研究人员了解暴露的控制系统设备的潜在风险 124 | 125 | - 其他/随机 126 | - [CitrixHoneypot](https://github.com/MalwareTech/CitrixHoneypot) - 检测记录 CVE-2019-19781 扫描与漏洞利用 127 | - [Damn Simple Honeypot (DSHP)](https://github.com/naorlivne/dshp) - 带有插件化支持的简单蜜罐 128 | - [dicompot](https://github.com/nsmfoo/dicompot) - DICOM 蜜罐 129 | - [IPP Honey](https://gitlab.com/bontchev/ipphoney) - IPP 蜜罐 130 | - [Log4Pot](https://github.com/thomaspatzke/Log4Pot) - Log4Shell（CVE-2021-44228）蜜罐 131 | - [Masscanned](https://github.com/ivre/masscanned) - 专注于扫描与 Bot 的低交互蜜罐，能够与 IVRE 很好地集成在一起使用构建类似 GreyNoise 的替代方案 132 | - [medpot](https://github.com/schmalle/medpot) - HL7 / FHIR honeypot. 133 | - [NOVA](https://github.com/DataSoft/Nova) 看起来像完整系统的蜜罐 134 | - [OpenFlow Honeypot（OFPot）](https://github.com/upa/ofpot) - 基于 POX 的 OpenFlow 蜜罐，将未使用的IP地址的流量重定向到蜜罐中 135 | - [OpenCanary](https://pypi.org/project/opencanary/) - 模块化、分布式蜜罐 136 | - [ciscoasa_honeypot](https://github.com/cymmetria/ciscoasa_honeypot) 用于思科 ASA 低交互蜜罐，检测 CVE-2018-0101 远程代码执行漏洞 137 | - [miniprint](https://github.com/sa7mon/miniprint) - 打印机中交互蜜罐 138 | 139 | - 僵尸网络 C&C 工具 140 | - [Hale](https://github.com/pjlantz/Hale) - 僵尸网络 C&C 监视器 141 | - [dnsMole](https://code.google.com/archive/p/dns-mole/) - 分析 DNS 流量，检测潜在的僵尸网络 C&C 服务器和受感染的主机 142 | 143 | - IPv6 攻击检测工具 144 | - [ipv6-attack-detector](https://github.com/mzweilin/ipv6-attack-detector/) - Honeynet 项目支持的 Googel Summer of Code 2012 项目 145 | 146 | - 动态代码检查工具包 147 | - [Frida](https://www.frida.re) - 注入 JavaScript 来探索Windows、Mac、Linux、iOS 和 Android 上的应用程序 148 | 149 | - 将网站转换为服务器蜜罐 150 | - [HIHAT](http://hihat.sourceforge.net/) - 将任意 PHP 页面转换成基于 Web 的高交互蜜罐 151 | 152 | - 恶意软件收集 153 | - [Kippo-Malware](https://bruteforcelab.com/kippo-malware) - 用于在 Kippo SSH 蜜罐数据库中记录的 URL 上下载恶恶意文件的 Python 脚本 154 | 155 | - 分布式传感器部署 156 | - [Community Honey Network](https://communityhoneynetwork.readthedocs.io/en/stable/) - CHN 旨在使部署蜜罐和蜜罐管理变得简单灵活，默认使用 Docker Compose 和 Docker 进行部署 157 | - [Modern Honey Network](https://github.com/threatstream/mhn) - 分布式 Snort 与蜜罐传感器管理，使用虚拟网络，最小指纹的 SNORT 安装，服务器提供隐形侦察与集中管理 158 | 159 | - 网络分析工具 160 | - [Tracexploit](https://code.google.com/archive/p/tracexploit/) - 重放网络数据包 161 | 162 | - 日志匿名工具 163 | - [LogAnon](http://code.google.com/archive/p/loganon/) - 日志匿名库 164 | 165 | - 低交互蜜罐（路由器后门） 166 | - [Honeypot-32764](https://github.com/knalli/honeypot-for-tcp-32764) - 路由器后门蜜罐(TCP 32764). 167 | - [WAPot](https://github.com/lcashdol/WAPot) - 能够观察家庭路由器流量的蜜罐 168 | 169 | - 蜜罐流量重定向 170 | - [Honeymole](https://web.archive.org/web/20100326040550/http://www.honeynet.org.pt:80/index.php/HoneyMole) - 部署多个传感器回传流量到集中蜜罐中的工具 171 | 172 | - HTTPS 代理 173 | - [mitmproxy](https://mitmproxy.org/) - 拦截、检查、修改、重放流量 174 | 175 | - 系统插桩 176 | - [Sysdig](https://sysdig.com/opensource/) - 捕获 Linux 系统的状态与活动，可以进行保存、过滤与分析的开源系统级探索工具 177 | - [Fibratus](https://github.com/rabbitstack/fibratus) - 用于探索和跟踪 Windows 内核的工具 178 | 179 | - 检测 USB 恶意传播的蜜罐 180 | - [Ghost-usb](https://github.com/honeynet/ghost-usb-honeypot) - 检测通过 USB 存储设备传播恶意软件的蜜罐 181 | 182 | - 数据采集 183 | - [Kippo2MySQL](https://bruteforcelab.com/kippo2mysql) - 从 Kippo 的日志文件中提取一些基本的统计信息插入到数据库中 184 | - [Kippo2ElasticSearch](https://bruteforcelab.com/kippo2elasticsearch) - 用于将 Kippo SSH 蜜罐数据从 MySQL 数据库传输到 ElasticSearch 实例（服务器或集群）的 Python 脚本 185 | 186 | - 被动网络审计框架解析工具 187 | - [Passive Network Audit Framework（pnaf）](https://github.com/jusafing/pnaf) - 被动网络审计框架 188 | 189 | - 虚拟机监控工具 190 | - [Antivmdetect](https://github.com/nsmfoo/antivmdetection) - 用于创建 VirtualBox 虚拟机模版的脚本，使检测虚拟机更困难 191 | - [VMCloak](https://github.com/hatching/vmcloak) - Cuckoo 沙盒的自动虚拟机生成和隐藏 192 | - [vmitools](http://libvmi.com/) - 带有 Python 接口的 C 库，可以轻松监视运行中的虚拟机的底层细节 193 | 194 | - 二进制调试器 195 | - [Hexgolems - Pint Debugger Backend](https://github.com/hexgolems/pint) - 一个调试器后端与 Pin 的 Lua 接口 196 | - [Hexgolems - Schem Debugger Frontend](https://github.com/hexgolems/schem) - 一个调试器前端 197 | 198 | - 移动应用分析工具 199 | - [Androguard](https://github.com/androguard/androguard) - 安卓应用程序逆向工程工具 200 | - [APKinspector](https://github.com/honeynet/apkinspector/) - 带有界面的安卓应用程序分析工具 201 | 202 | - 低交互蜜罐 203 | - [Honeyperl](https://sourceforge.net/projects/honeyperl/) - 基于 Perl 的蜜罐，有很多插件 204 | - [T-Pot](https://github.com/dtag-dev-sec/tpotce) - 为电信服务商 T-Mobile 提供的蜜罐 205 | - [beelzebub](https://github.com/mariocandela/beelzebub) - 蜜罐框架，支持通过 YAML 进行配置 🚀 206 | 207 | - 蜜罐数据融合 208 | - [HFlow2](https://projects.honeynet.org/hflow) - 用于蜜罐/网络分析的数据融合工具 209 | 210 | - 服务器 211 | - [Amun](http://amunhoney.sourceforge.net) - 漏洞模拟蜜罐 212 | - [Artillery](https://github.com/trustedsec/artillery/) - 开源蓝队工具，旨在通过多种办法保护 Linux 和 Windows 操作系统 213 | - [Bait and Switch](http://baitnswitch.sourceforge.net) - 将恶意流量重定向到生产系统镜像的蜜罐 214 | - [Bifrozt](https://github.com/Ziemeck/bifrozt-ansible) - 自动部署带有 ansible 的 bifrozt 215 | - [Conpot](http://conpot.org/) - 低交互的工业控制系统蜜罐 216 | - [Heralding](https://github.com/johnnykv/heralding) - 捕获凭据的蜜罐 217 | - [HoneyWRT](https://github.com/CanadianJeff/honeywrt) - 基于 Python 的低交互蜜罐，旨在模拟攻击者可能攻击的服务或端口 218 | - [Honeyd](https://github.com/provos/honeyd) 请查看[更多 honeyd 工具](#honeyd) 219 | - [Honeysink](http://www.honeynet.org/node/773) - 开源网络陷阱，提供了检测与阻止指定网络上恶意流量的机制 220 | - [Hontel](https://github.com/stamparm/hontel) - Telnet 蜜罐 221 | - [KFSensor](http://www.keyfocus.net/kfsensor/) - 基于 Windows 的入侵检测系统蜜罐 222 | - [LaBrea](http://labrea.sourceforge.net/labrea-info.html) - 接管未使用的 IP 地址，创建对蠕虫、黑客有吸引力的虚拟服务 223 | - [MTPot](https://github.com/Cymmetria/MTPot) - 专注于 Mirai 的开源 Telnet 蜜罐 224 | - [SIREN](https://github.com/blaverick62/SIREN) - 半智能蜜罐网络 - 蜜网只能虚拟环境 225 | - [TelnetHoney](https://github.com/balte/TelnetHoney) - 简单的 telnet 蜜罐 226 | - [UDPot Honeypot](https://github.com/jekil/UDPot) - 简单 UDP / DNS 蜜罐脚本 227 | - [Yet Another Fake Honeypot (YAFH)](https://github.com/fnzv/YAFH) - 使用 Go 编写的简单蜜罐 228 | - [arctic-swallow](https://github.com/ajackal/arctic-swallow) - 低交互蜜罐 229 | - [fapro](https://github.com/fofapro/fapro) - 虚假协议服务器 230 | - [glutton](https://github.com/mushorg/glutton) - 可喂食蜜罐 231 | - [go-HoneyPot](https://github.com/Mojachieee/go-HoneyPot) - 使用 Go 编写的蜜罐 232 | - [go-emulators](https://github.com/kingtuna/go-emulators) - Go 蜜罐模拟器 233 | - [honeymail](https://github.com/sec51/honeymail) - 使用 Go 编写的 SMTP 蜜罐 234 | - [honeytrap](https://github.com/tillmannw/honeytrap) - 一个用于捕获针对 TCP 和 UDP 服务攻击的低交互蜜罐 235 | - [imap-honey](https://github.com/yvesago/imap-honey) - 使用 Go 编写的 IMAP 蜜罐 236 | - [mwcollectd](https://www.openhub.net/p/mwcollectd) - 联合 nepenthes 和 honeytrap 的最佳功能实现的多功能恶意软件收集蜜罐 237 | - [potd](https://github.com/lnslbrty/potd) - 使用 Linux 的 Namespaces、Seccomp 与 Capabilities 构建针对 OpenWrt/IoT 设备的低中交互 SSH/TCP 蜜罐 238 | - [portlurker](https://github.com/bartnv/portlurker) - 用于协议猜测和安全字符显示的端口监听工具/蜜罐 239 | - [slipm-honeypot](https://github.com/rshipp/slipm-honeypot) - 简单的低交互端口监听蜜罐 240 | - [telnet-iot-honeypot](https://github.com/Phype/telnet-iot-honeypot) - 为了捕获僵尸网络二进制文件，使用 Python 编写的 telnet 蜜罐 241 | - [telnetlogger](https://github.com/robertdavidgraham/telnetlogger) - 跟踪 Mirai 的 Telnet 蜜罐 242 | - [vnclowpot](https://github.com/magisterquis/vnclowpot) - 低交互的 VNC 蜜罐 243 | 244 | - IDS 签名生成 245 | - [Honeycomb](http://www.icir.org/christian/honeycomb/) - 使用蜜罐自动创建签名 246 | 247 | - 查找服务提供商的 ASN 与前缀 248 | - [CC2ASN](http://www.cc2asn.com/) - 属于世界上任何给定国家的 AS 编号和前缀的查询服务 249 | 250 | - 数据收集/数据共享 251 | - [HPfriends](http://hpfriends.honeycloud.net/#/home) - 蜜罐数据共享平台 252 | - [hpfriends](https://heipei.io/sigint-hpfriends/) - 关于 HPFriends feed 系统的介绍 253 | - [HPFeeds](https://github.com/rep/hpfeeds/) - 轻量认证的订阅发布协议 254 | 255 | - 集中管理工具 256 | - [PHARM](http://www.nepenthespharm.com/) - 管理、统计、分析你的分布式 Nepenthes 蜜罐 257 | 258 | - 网络连接分析工具 259 | - [Impost](http://impost.sourceforge.net/) - 网络安全审计工具，用于取证分析被破坏/易受攻击的守护进程 260 | 261 | - 蜜罐部署 262 | - [honeyfs](https://github.com/referefref/honeyfs) - 为中/高交互蜜罐创建文件系统的工具 263 | - [Modern Honeynet Network](http://threatstream.github.io/mhn/) - 让蜜罐的管理与部署更简单 264 | 265 | - Wireshark 的蜜罐扩展 266 | - [Wireshark Extensions](https://www.honeynet.org/project/WiresharkExtensions) - 支持应用针对 PCAP 文件的 Snort IDS 规则与签名 267 | 268 | - 客户端蜜罐 269 | - [CWSandbox / GFI Sandbox](https://www.gfi.com/products-and-solutions/all-products) 270 | - [Capture-HPC-Linux](https://redmine.honeynet.org/projects/linux-capture-hpc/wiki) 271 | - [Capture-HPC-NG](https://github.com/CERT-Polska/HSN-Capture-HPC-NG) 272 | - [Capture-HPC](https://projects.honeynet.org/capture-hpc) - 高交互客户端蜜罐 273 | - [HoneyBOT](http://www.atomicsoftwaresolutions.com/) 274 | - [HoneyC](https://projects.honeynet.org/honeyc) 275 | - [HoneySpider Network](https://github.com/CERT-Polska/hsn2-bundle) - 集成多个客户端蜜罐检测恶意网站的可扩展系统 276 | - [HoneyWeb](https://code.google.com/archive/p/gsoc-honeyweb/) - 为管理与远程共享 Honeyclients 资源而创建的 Web 界面 277 | - [Jsunpack-n](https://github.com/urule99/jsunpack-n) 278 | - [MonkeySpider](http://monkeyspider.sourceforge.net) 279 | - [PhoneyC](https://github.com/honeynet/phoneyc) 280 | - [Pwnypot](https://github.com/shjalayeri/pwnypot) - 高交互客户端蜜罐 281 | - [Rumal](https://github.com/thugs-rumal/) 282 | - [Shelia](https://www.cs.vu.nl/~herbertb/misc/shelia/) 283 | - [Thug](https://buffer.github.io/thug/) 284 | - [Thug Distributed Task Queuing](https://thug-distributed.readthedocs.io/en/latest/index.html) 285 | - [Trigona](https://www.honeynet.org/project/Trigona) 286 | - [URLQuery](https://urlquery.net/) 287 | - [YALIH (Yet Another Low Interaction Honeyclient)](https://github.com/Masood-M/yalih) - 低交互客户端蜜罐，旨在通过签名，异常和模式匹配技术检测恶意网站 288 | 289 | - 蜜罐 290 | - [Deception Toolkit](http://www.all.net/dtk/dtk.html) 291 | - [IMHoneypot](https://github.com/mushorg/imhoneypot) 292 | 293 | - PDF 文档检查工具 294 | - [peepdf](https://github.com/jesparza/peepdf) 295 | 296 | - 混合低/高交互蜜罐 297 | - [HoneyBrid](http://honeybrid.sourceforge.net) 298 | 299 | - SSH 蜜罐 300 | - [Blacknet](https://github.com/morian/blacknet) - SSH 蜜罐系统 301 | - [Cowrie](https://github.com/cowrie/cowrie) - Cowrie SSH 蜜罐 (基于 kippo) 302 | - [DShield docker](https://github.com/xme/dshield-docker) - 启用了 DShield 输出的 Docker 容器 303 | - [endlessh](https://github.com/skeeto/endlessh) - SSH 蜜罐，支持([docker](https://hub.docker.com/r/linuxserver/endlessh))镜像 304 | - [HonSSH](https://github.com/tnich/honssh) - 记录客户端与服务器之间所有 SSH 通信 305 | - [HUDINX](https://github.com/Cryptix720/HUDINX) - 用于记录暴力破解的低交互 SSH 蜜罐，记录攻击者全部 Shell 交互 306 | - [Kippo](https://github.com/desaster/kippo) - 中交互 SSH 蜜罐 307 | - [Kippo_JunOS](https://github.com/gregcmartin/Kippo_JunOS) - 基于 Kippo 的蜜罐 308 | - [Kojoney2](https://github.com/madirish/kojoney2) - Jose Antonio Coret 使用 Python 编写，基于 Kojoney 的低交互 SSH 蜜罐 309 | - [Kojoney](http://kojoney.sourceforge.net/) - 基于 Python 的低交互蜜罐，使用 Twisted Conch 模拟 SSH 服务 310 | - [Longitudinal Analysis of SSH Cowrie Honeypot Logs](https://github.com/deroux/longitudinal-analysis-cowrie) - 基于 Python 的命令行工具，用于分析一段时间内的 cowrie 日志 311 | - [LongTail Log Analysis @ Marist College](http://longtail.it.marist.edu/honey/) - 分析 SSH 蜜罐日志 312 | - [Malbait](https://github.com/batchmcnulty/Malbait) - 使用 Perl 实现的 TCP/UDP 蜜罐 313 | - [MockSSH](https://github.com/ncouture/MockSSH) - 支持定义的所有命令的 SSH 服务器 314 | - [cowrie2neo](https://github.com/xlfe/cowrie2neo) - 解析 cowrie 蜜罐日志到 neo4j 数据库 315 | - [go-sshoney](https://github.com/ashmckenzie/go-sshoney) - SSH 蜜罐 316 | - [go0r](https://github.com/fzerorubigd/go0r) - 使用 Go 编写的简单 SSH 蜜罐 317 | - [gohoney](https://github.com/PaulMaddox/gohoney) - 使用 Go 编写的 SSH 蜜罐 318 | - [hived](https://github.com/sahilm/hived) - 基于 Go 编写的蜜罐 319 | - [hnypots-agent)](https://github.com/joshrendek/hnypots-agent) - 记录用户名和密码组合的 SSH 服务器 320 | - [honeypot.go](https://github.com/mdp/honeypot.go) - 使用 Go 编写的 SSH 蜜罐 321 | - [honeyssh](https://github.com/ppacher/honeyssh) - 凭据 dumping 的 SSH 蜜罐 322 | - [hornet](https://github.com/czardoz/hornet) - 支持多虚拟主机的中交互 SSH 蜜罐 323 | - [ssh-auth-logger](https://github.com/JustinAzoff/ssh-auth-logger) - 低\零交互 SSH 蜜罐 324 | - [ssh-honeypot](https://github.com/droberson/ssh-honeypot) - 伪造 SSHD，记录 IP 地址、用户名与密码 325 | - [ssh-honeypot](https://github.com/amv42/sshd-honeypot) - OpenSSH DEAMON 的改版，将命令转发到 Cowrie 326 | - [ssh-honeypotd](https://github.com/sjinks/ssh-honeypotd) - C 编写的低交互 SSH 蜜罐 327 | - [sshForShits](https://github.com/traetox/sshForShits) - 高交互 SSH 蜜罐框架 328 | - [sshesame](https://github.com/jaksi/sshesame) - 记录登录活动的虚假 SSH 服务器 329 | - [sshhipot](https://github.com/magisterquis/sshhipot) - 高交互中间人 SSH 蜜罐 330 | - [sshlowpot](https://github.com/magisterquis/sshlowpot) - Go 编写的低交互 SSH 蜜罐 331 | - [sshsyrup](https://github.com/mkishere/sshsyrup) - 简单的 SSH 蜜罐，捕获终端活动并上传到 asciinema.org 332 | - [twisted-honeypots](https://github.com/lanjelot/twisted-honeypots) - 基于 Twisted 的 SSH\FTP\Telnet 的蜜罐 333 | 334 | - 分布式传感器项目 335 | - [DShield Web Honeypot Project](https://sites.google.com/site/webhoneypotsite/) 336 | 337 | - PCAP 分析工具 338 | - [Honeysnap](https://projects.honeynet.org/honeysnap/) 339 | 340 | - 网络流量重定向工具 341 | - [Honeywall](https://projects.honeynet.org/honeywall/) 342 | 343 | - 混合内容的分布式蜜罐 344 | - [HoneyDrive](https://bruteforcelab.com/honeydrive) 345 | 346 | - 蜜罐传感器 347 | - [Honeeepi](https://redmine.honeynet.org/projects/honeeepi/wiki) - Raspberry Pi 上一款基于定制 Raspbian 操作系统的蜜罐 348 | 349 | - File carving 350 | - [TestDisk & PhotoRec](https://www.cgsecurity.org/) 351 | 352 | - Windows 可用的行为分析工具 353 | - [Capture BAT](https://www.honeynet.org/node/315) 354 | 355 | - Live CD 356 | - [DAVIX](https://www.secviz.org/node/89) - DAVIX Released 357 | 358 | - Spamtrap 359 | - [Mail::SMTP::Honeypot](https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - 提供标准 SMTP 服务器工具的 Perl 模块 360 | - [Mailoney](https://github.com/awhitehatter/mailoney) - Python 编写的 SMTP 蜜罐，具有开放中继、凭据记录等功能 361 | - [SendMeSpamIDS.py](https://github.com/johestephan/VerySimpleHoneypot) - 获得所有 IDS 和分析设备的简单 SMTP 362 | - [Shiva](https://github.com/shiva-spampot/shiva) - 垃圾邮件蜜罐与智能分析工具 363 | - [Shiva The Spam Honeypot Tips And Tricks For Getting It Up And Running](https://www.pentestpartners.com/security-blog/shiva-the-spam-honeypot-tips-and-tricks-for-getting-it-up-and-running/) 364 | - [SMTPLLMPot](https://github.com/referefref/SMTPLLMPot) - 使用 GPT 3.5 的简单 SMTP 蜜罐 365 | - [SpamHAT](https://github.com/miguelraulb/spamhat) - 垃圾邮件蜜罐工具 366 | - [Spamhole](http://www.spamhole.net/) 367 | - [honeypot](https://github.com/jadb/honeypot) - 蜜罐项目组非官方 PHP 的 SDK 368 | - [spamd](http://man.openbsd.org/cgi-bin/man.cgi?query=spamd%26apropos=0%26sektion=0%26manpath=OpenBSD+Current%26arch=i386%26format=html) 369 | 370 | - 商业蜜网 371 | - [Cymmetria Mazerunner](https://cymmetria.com/products/mazerunner/) - 可引导攻击者远离真实目标，并创建攻击痕迹跟踪 372 | 373 | - 服务器（蓝牙） 374 | - [Bluepot](https://github.com/andrewmichaelsmith/bluepot) 375 | 376 | - Android 应用程序动态分析 377 | - [Droidbox](https://code.google.com/archive/p/droidbox/) 378 | 379 | - Docker 化的低交互蜜罐 380 | - [Docker honeynet](https://github.com/sreinhardt/Docker-Honeynet) - 部署与 Docker 容器中的一些蜜网工具 381 | - [Dockerized Thug](https://hub.docker.com/r/honeynet/thug/) - 基于 [Thug](https://github.com/buffer/thug) 的 Docker 蜜罐，用于分析恶意 Web 内容 382 | - [Dockerpot](https://github.com/mrschyte/dockerpot) - 基于 Docker 的蜜罐 383 | - [Manuka](https://github.com/andrewmichaelsmith/manuka) - 基于 Docker 的蜜罐 (Dionaea & Kippo) 384 | - [honey_ports](https://github.com/run41/honey_ports) - 利用 Docker 进行蜜罐的部署发现端口扫描简单有效的办法 385 | - [mhn-core-docker](https://github.com/MattCarothers/mhn-core-docker) - 在 Docker 中实现的现代蜜网核心元素 386 | 387 | - 网络分析 388 | - [Quechua](https://bitbucket.org/zaccone/quechua) 389 | 390 | - SIP Server 391 | - [Artemnesia VoIP](http://artemisa.sourceforge.net) 392 | 393 | - SIP 394 | - [SentryPeer](https://github.com/SentryPeer/SentryPeer) - 保护 SIP 服务器免于攻击 395 | 396 | - IOT 蜜罐 397 | - [HoneyThing](https://github.com/omererdem/honeything) - TR-069 蜜罐 398 | - [Kako](https://github.com/darkarnium/kako) - 常见嵌入式设备漏洞的蜜罐 399 | 400 | - Honeytokens 401 | - [CanaryTokens](https://github.com/thinkst/canarytokens) - Honeytoken 生成器，Dashboard 在 [CanaryTokens.org](https://canarytokens.org/generate) 402 | - [Honeybits](https://github.com/0x4D31/honeybits) - 旨在通过在生产服务器和工作站中传播 breadcrumbs 和 honeytokens 来诱使攻击者进入蜜罐，从而提高诱捕率 403 | - [Honeyλ (HoneyLambda)](https://github.com/0x4D31/honeylambda) - 简单的无服务器应用程序，旨在创建和监控 AWS Lambda 和 Amazon API Gateway 之上的网址 honeytokens 404 | - [dcept](https://github.com/secureworks/dcept) - 部署、检测活动目录使用情况的 honeytokens 405 | - [honeyku](https://github.com/0x4D31/honeyku) - 基于 Heroku 的 Web 蜜罐 406 | 407 | ## Honeyd工具 408 | 409 | - Honeyd 插件 410 | - [Honeycomb](http://www.honeyd.org/tools.php) 411 | 412 | - Honeyd 查看工具 413 | - [Honeyview](http://honeyview.sourceforge.net/) 414 | 415 | - Honeyd 与 MySQL 的连接 416 | - [Honeyd2MySQL](https://bruteforcelab.com/honeyd2mysql) 417 | 418 | - Honeyd 统计数据可视化脚本 419 | - [Honeyd-Viz](https://bruteforcelab.com/honeyd-viz) 420 | 421 | - Honeyd 统计 422 | - [Honeydsum.pl](https://github.com/DataSoft/Honeyd/blob/master/scripts/misc/honeydsum-v0.3/honeydsum.pl) 423 | 424 | 425 | ## 网络与行为分析 426 | 427 | - 沙盒 428 | - [Argos](http://www.few.vu.nl/argos/) - 用于捕获零日攻击的模拟器 429 | - [COMODO automated sandbox](https://help.comodo.com/topic-72-1-451-4768-.html) 430 | - [Cuckoo](https://cuckoosandbox.org/) - 领先的开源自动化恶意软件分析系统 431 | - [Pylibemu](https://github.com/buffer/pylibemu) - Libemu Cython 432 | - [RFISandbox](https://monkey.org/~jose/software/rfi-sandbox/) - 使用 PHP 5.x 脚本在 [funcall](https://pecl.php.net/package/funcall) 上构建的沙盒 433 | - [dorothy2](https://github.com/m4rco-/dorothy2) - Ruby 编写的恶意软件/僵尸网络分析框架 434 | - [imalse](https://github.com/hbhzwj/imalse) - 集成的恶意软件仿真工具与模拟工具 435 | - [libemu](https://github.com/buffer/libemu) - Shellcode 模拟库，对 Shellcode 检测十分有用 436 | 437 | - 沙盒即服务 438 | - [Hybrid Analysis](https://www.hybrid-analysis.com) - 由 Payload Security 提供的免费恶意软件分析服务，可使用其独特的混合分析技术检测和分析未知威胁 439 | - [Joebox Cloud](https://jbxcloud.joesecurity.org/login) - 确定 Windows、Android 和 Mac OS X 上的恶意文件（包括 PE、PDF、DOC、PPT、XLS、APK、URL 和 MachO）的行为，判断其是否存在可疑活动 440 | - [VirusTotal](https://www.virustotal.com/) 441 | - [malwr.com](https://malwr.com/) - 提供免费恶意软件分析服务与社区 442 | 443 | ## 数据分析工具 444 | 445 | - 前端 446 | - [DionaeaFR](https://github.com/rubenespadas/DionaeaFR) - Dionaea 蜜罐前端 Web 447 | - [Django-kippo](https://github.com/jedie/django-kippo) - 用于 kippo SSH 蜜罐的 Django 程序 448 | - [Shockpot-Frontend](https://github.com/GovCERT-CZ/Shockpot-Frontend) - 用于可视化 Shockpot 蜜罐中数据的脚本 449 | - [Tango](https://github.com/aplura/Tango) - 使用 Splunk 处理蜜罐情报 450 | - [Wordpot-Frontend](https://github.com/GovCERT-CZ/Wordpot-Frontend) - 用于可视化 Wordpot 蜜罐中数据的脚本 451 | - [honeyalarmg2](https://github.com/schmalle/honeyalarmg2) - 用于显示蜜罐数据的简化 UI 452 | - [honeypotDisplay](https://github.com/Joss-Steward/honeypotDisplay) - 展示 SSH 蜜罐的 Flask 网站 453 | 454 | - 可视化 455 | - [Acapulco](https://github.com/hgascon/acapulco) - 自动攻击群体图构建 456 | - [Afterglow Cloud](https://github.com/ayrus/afterglow-cloud) 457 | - [Afterglow](http://afterglow.sourceforge.net/) 458 | - [Glastopf Analytics](https://github.com/katkad/Glastopf-Analytics) - 简单蜜罐统计 459 | - [HoneyMalt](https://github.com/SneakersInc/HoneyMalt) - Maltego 转换映射蜜罐系统 460 | - [HoneyMap](https://github.com/fw42/honeymap) - 显示实时 Websocket 流的 SVG 地图 461 | - [HoneyStats](https://sourceforge.net/projects/honeystats/) - Honeynet 的统计视图 462 | - [HpfeedsHoneyGraph](https://github.com/yuchincheng/HpfeedsHoneyGraph) - 可视化 hpfeeds 日志的程序 463 | - [IVRE](https://github.com/ivre/ivre) - 由 @cea-sec 和 @ANSSI-FR 开发的网络侦察框架，作为 Criminalip/Shodan/ZoomEye/Censys 和 GreyNoise 的替代方案，收集各种情报 464 | - [Kippo stats](https://github.com/mfontani/kippo-stats) - 为 kippo SSH 蜜罐展示数据的程序 465 | - [Kippo-Graph](https://bruteforcelab.com/kippo-graph) - 用于可视化 Kippo 蜜罐中数据的脚本 466 | - [The Intelligent HoneyNet](https://github.com/jpyorre/IntelligentHoneyNet) - 试图创建蜜罐中可操作信息的智能蜜网项目 467 | - [ovizart](https://github.com/oguzy/ovizart) - 可视化网络流量分析 468 | 469 | ## 指南 470 | 471 | - [T-Pot: 多蜜罐平台](https://dtag-dev-sec.github.io/mediator/feature/2015/03/17/concept.html) 472 | - [蜜罐 (Dionaea and kippo) 设置脚本](https://github.com/andrewmichaelsmith/honeypot-setup-script/) 473 | 474 | - 部署 475 | - [Dionaea and EC2 in 20 Minutes](http://andrewmichaelsmith.com/2012/03/dionaea-honeypot-on-ec2-in-20-minutes/) - 在 EC2 上设置 Dionaea 的教程 476 | - [Using a Raspberry Pi honeypot to contribute data to DShield/ISC](https://isc.sans.edu/diary/22680) - 基于 Raspberry Pi 的系统可以收集比防火墙日志更丰富的日志 477 | - [honeypotpi](https://github.com/free5ty1e/honeypotpi) - 将 Raspberry Pi 变成 HoneyPot Pi 的脚本 478 | 479 | - 研究论文 480 | - [Honeypot research papers](https://github.com/shbhmsingh72/Honeypot-Research-Papers) - 研究蜜罐论文的 PDF 481 | - [vEYE](https://link.springer.com/article/10.1007%2Fs10115-008-0137-3) - 自传播蠕虫行为痕迹的检测与分析 482 | -------------------------------------------------------------------------------- /awesome-check.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | 3 | import re 4 | import sys 5 | import urllib2 6 | 7 | with open(sys.argv[1], 'r') as f: 8 | for line in f.readlines(): 9 | if '](http' in line: 10 | for url in re.findall("(http[s?]://[^)]+)", line): 11 | # print url 12 | try: 13 | request = urllib2.Request(url) 14 | request.get_method = lambda : 'HEAD' 15 | resp = urllib2.urlopen(request) 16 | if resp.getcode() != 200: 17 | print 'ERROR - ', line 18 | except urllib2.URLError, e: 19 | print e, line --------------------------------------------------------------------------------