├── .travis.yml ├── awesome-check.py ├── CONTRIBUTING.md ├── LICENSE ├── README_CN.md └── README.md /.travis.yml: -------------------------------------------------------------------------------- 1 | language: ruby 2 | rvm: 3 | - 2.2 4 | before_script: 5 | - gem install awesome_bot 6 | script: 7 | - awesome_bot README.md --white-list https://github.com/sindresorhus/awesome,http://hpfriends.honeycloud.net/#/home,https://malwr.com/ 8 | - awesome_bot README_CN.md --white-list https://github.com/sindresorhus/awesome,http://hpfriends.honeycloud.net/#/home,https://malwr.com/ 9 | 10 | -------------------------------------------------------------------------------- /awesome-check.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | 3 | import re 4 | import sys 5 | import urllib2 6 | 7 | with open(sys.argv[1], 'r') as f: 8 | for line in f.readlines(): 9 | if '](http' in line: 10 | for url in re.findall("(http[s?]://[^)]+)", line): 11 | # print url 12 | try: 13 | request = urllib2.Request(url) 14 | request.get_method = lambda : 'HEAD' 15 | resp = urllib2.urlopen(request) 16 | if resp.getcode() != 200: 17 | print 'ERROR - ', line 18 | except urllib2.URLError, e: 19 | print e, line -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contribution Guidelines 2 | 3 | Please ensure your pull request adheres to the following guidelines: 4 | 5 | - Search previous suggestions before making a new one, as yours may be a duplicate. 6 | - Make an individual pull request for each suggestion. 7 | - Use the following format: `[PACKAGE](LINK) - DESCRIPTION.` 8 | - New categories, or improvements to the existing categorization are welcome. 9 | - Keep descriptions short and simple, but descriptive. 10 | - End all descriptions with a full stop/period. 11 | - Check your spelling and grammar. 12 | - Make sure your text editor is set to remove trailing whitespace. 13 | 14 | Your contributions are always welcome! Thank you for your suggestions! 15 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | The Artistic License 2.0 2 | 3 | Copyright (c) 2015 jose nazario 4 | 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | This license establishes the terms under which a given free software 11 | Package may be copied, modified, distributed, and/or redistributed. 12 | The intent is that the Copyright Holder maintains some artistic 13 | control over the development of that Package while still keeping the 14 | Package available as open source and free software. 15 | 16 | You are always permitted to make arrangements wholly outside of this 17 | license directly with the Copyright Holder of a given Package. If the 18 | terms of this license do not permit the full use that you propose to 19 | make of the Package, you should contact the Copyright Holder and seek 20 | a different licensing arrangement. 21 | 22 | Definitions 23 | 24 | "Copyright Holder" means the individual(s) or organization(s) 25 | named in the copyright notice for the entire Package. 26 | 27 | "Contributor" means any party that has contributed code or other 28 | material to the Package, in accordance with the Copyright Holder's 29 | procedures. 30 | 31 | "You" and "your" means any person who would like to copy, 32 | distribute, or modify the Package. 33 | 34 | "Package" means the collection of files distributed by the 35 | Copyright Holder, and derivatives of that collection and/or of 36 | those files. A given Package may consist of either the Standard 37 | Version, or a Modified Version. 38 | 39 | "Distribute" means providing a copy of the Package or making it 40 | accessible to anyone else, or in the case of a company or 41 | organization, to others outside of your company or organization. 42 | 43 | "Distributor Fee" means any fee that you charge for Distributing 44 | this Package or providing support for this Package to another 45 | party. It does not mean licensing fees. 46 | 47 | "Standard Version" refers to the Package if it has not been 48 | modified, or has been modified only in ways explicitly requested 49 | by the Copyright Holder. 50 | 51 | "Modified Version" means the Package, if it has been changed, and 52 | such changes were not explicitly requested by the Copyright 53 | Holder. 54 | 55 | "Original License" means this Artistic License as Distributed with 56 | the Standard Version of the Package, in its current version or as 57 | it may be modified by The Perl Foundation in the future. 58 | 59 | "Source" form means the source code, documentation source, and 60 | configuration files for the Package. 61 | 62 | "Compiled" form means the compiled bytecode, object code, binary, 63 | or any other form resulting from mechanical transformation or 64 | translation of the Source form. 65 | 66 | 67 | Permission for Use and Modification Without Distribution 68 | 69 | (1) You are permitted to use the Standard Version and create and use 70 | Modified Versions for any purpose without restriction, provided that 71 | you do not Distribute the Modified Version. 72 | 73 | 74 | Permissions for Redistribution of the Standard Version 75 | 76 | (2) You may Distribute verbatim copies of the Source form of the 77 | Standard Version of this Package in any medium without restriction, 78 | either gratis or for a Distributor Fee, provided that you duplicate 79 | all of the original copyright notices and associated disclaimers. At 80 | your discretion, such verbatim copies may or may not include a 81 | Compiled form of the Package. 82 | 83 | (3) You may apply any bug fixes, portability changes, and other 84 | modifications made available from the Copyright Holder. The resulting 85 | Package will still be considered the Standard Version, and as such 86 | will be subject to the Original License. 87 | 88 | 89 | Distribution of Modified Versions of the Package as Source 90 | 91 | (4) You may Distribute your Modified Version as Source (either gratis 92 | or for a Distributor Fee, and with or without a Compiled form of the 93 | Modified Version) provided that you clearly document how it differs 94 | from the Standard Version, including, but not limited to, documenting 95 | any non-standard features, executables, or modules, and provided that 96 | you do at least ONE of the following: 97 | 98 | (a) make the Modified Version available to the Copyright Holder 99 | of the Standard Version, under the Original License, so that the 100 | Copyright Holder may include your modifications in the Standard 101 | Version. 102 | 103 | (b) ensure that installation of your Modified Version does not 104 | prevent the user installing or running the Standard Version. In 105 | addition, the Modified Version must bear a name that is different 106 | from the name of the Standard Version. 107 | 108 | (c) allow anyone who receives a copy of the Modified Version to 109 | make the Source form of the Modified Version available to others 110 | under 111 | 112 | (i) the Original License or 113 | 114 | (ii) a license that permits the licensee to freely copy, 115 | modify and redistribute the Modified Version using the same 116 | licensing terms that apply to the copy that the licensee 117 | received, and requires that the Source form of the Modified 118 | Version, and of any works derived from it, be made freely 119 | available in that license fees are prohibited but Distributor 120 | Fees are allowed. 121 | 122 | 123 | Distribution of Compiled Forms of the Standard Version 124 | or Modified Versions without the Source 125 | 126 | (5) You may Distribute Compiled forms of the Standard Version without 127 | the Source, provided that you include complete instructions on how to 128 | get the Source of the Standard Version. Such instructions must be 129 | valid at the time of your distribution. If these instructions, at any 130 | time while you are carrying out such distribution, become invalid, you 131 | must provide new instructions on demand or cease further distribution. 132 | If you provide valid instructions or cease distribution within thirty 133 | days after you become aware that the instructions are invalid, then 134 | you do not forfeit any of your rights under this license. 135 | 136 | (6) You may Distribute a Modified Version in Compiled form without 137 | the Source, provided that you comply with Section 4 with respect to 138 | the Source of the Modified Version. 139 | 140 | 141 | Aggregating or Linking the Package 142 | 143 | (7) You may aggregate the Package (either the Standard Version or 144 | Modified Version) with other packages and Distribute the resulting 145 | aggregation provided that you do not charge a licensing fee for the 146 | Package. Distributor Fees are permitted, and licensing fees for other 147 | components in the aggregation are permitted. The terms of this license 148 | apply to the use and Distribution of the Standard or Modified Versions 149 | as included in the aggregation. 150 | 151 | (8) You are permitted to link Modified and Standard Versions with 152 | other works, to embed the Package in a larger work of your own, or to 153 | build stand-alone binary or bytecode versions of applications that 154 | include the Package, and Distribute the result without restriction, 155 | provided the result does not expose a direct interface to the Package. 156 | 157 | 158 | Items That are Not Considered Part of a Modified Version 159 | 160 | (9) Works (including, but not limited to, modules and scripts) that 161 | merely extend or make use of the Package, do not, by themselves, cause 162 | the Package to be a Modified Version. In addition, such works are not 163 | considered parts of the Package itself, and are not subject to the 164 | terms of this license. 165 | 166 | 167 | General Provisions 168 | 169 | (10) Any use, modification, and distribution of the Standard or 170 | Modified Versions is governed by this Artistic License. By using, 171 | modifying or distributing the Package, you accept this license. Do not 172 | use, modify, or distribute the Package, if you do not accept this 173 | license. 174 | 175 | (11) If your Modified Version has been derived from a Modified 176 | Version made by someone other than you, you are nevertheless required 177 | to ensure that your Modified Version complies with the requirements of 178 | this license. 179 | 180 | (12) This license does not grant you the right to use any trademark, 181 | service mark, tradename, or logo of the Copyright Holder. 182 | 183 | (13) This license includes the non-exclusive, worldwide, 184 | free-of-charge patent license to make, have made, use, offer to sell, 185 | sell, import and otherwise transfer the Package with respect to any 186 | patent claims licensable by the Copyright Holder that are necessarily 187 | infringed by the Package. If you institute patent litigation 188 | (including a cross-claim or counterclaim) against any party alleging 189 | that the Package constitutes direct or contributory patent 190 | infringement, then this Artistic License to you shall terminate on the 191 | date that such litigation is filed. 192 | 193 | (14) Disclaimer of Warranty: 194 | THE PACKAGE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS "AS 195 | IS' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES. THE IMPLIED 196 | WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR 197 | NON-INFRINGEMENT ARE DISCLAIMED TO THE EXTENT PERMITTED BY YOUR LOCAL 198 | LAW. UNLESS REQUIRED BY LAW, NO COPYRIGHT HOLDER OR CONTRIBUTOR WILL 199 | BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL 200 | DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THE PACKAGE, EVEN IF 201 | ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 202 | 203 | -------------------------------------------------------------------------------- /README_CN.md: -------------------------------------------------------------------------------- 1 | # 最优秀的蜜罐列表 [![Awesome Honeypots](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/sindresorhus/awesome) 2 | 3 | 优秀的蜜罐、组件等等相关的工具列表，分为 Web、服务等多个类别，重点放在开源项目上 4 | 5 | 每个类别中没有顺序，按照提交的先后顺序排列，如果您也想提交，请阅读 [指南](CONTRIBUTING.md). 6 | 7 | 探索更多优秀的列表请参阅：[sindresorhus/awesome](https://github.com/sindresorhus/awesome). 8 | 9 | # 目录 10 | 11 | - [相关列表](#related-lists) 12 | - [蜜罐](#honeypots) 13 | - [Honeyd 工具](#honeyd-tools) 14 | - [网络与行为分析](#network-and-artifact-analysis) 15 | - [数据分析工具](#data-tools) 16 | - [指南](#guides) 17 | 18 | ## 相关列表 19 | 20 | - [awesome-pcaptools](https://github.com/caesar0301/awesome-pcaptools) 网络流量分析 21 | - [awesome-malware-analysis](https://github.com/rshipp/awesome-malware-analysis) 与上表有些重复，更侧重恶意软件分析 22 | 23 | ## 蜜罐 24 | 25 | - 数据库蜜罐 26 | - [Delilah](https://github.com/SecurityTW/delilah) - Python 编写的 Elasticsearch 蜜罐 27 | - [ESPot](https://github.com/mycert/ESPot) - 一个用 NodeJS 编写的 Elasticsearch 蜜罐，用于对 CVE-2014-3120 的利用 28 | - [Elastic honey](https://github.com/jordan-wright/elastichoney) - 简单的 Elasticsearch 蜜罐 29 | - [HoneyMysql](https://github.com/xiaoxiaoleo/HoneyMysql) - 简单 Mysql 蜜罐 30 | - [MongoDB-HoneyProxy](https://github.com/Plazmaz/MongoDB-HoneyProxy) - MongoDB 蜜罐代理 31 | - [MongoDB-HoneyProxyPy](https://github.com/jwxa2015/MongoDB-HoneyProxyPy) - 使用 Python 3 的 MongoDB 蜜罐代理 32 | - [NoSQLpot](https://github.com/torque59/nosqlpot) - NoSQL 蜜罐框架 33 | - [mysql-honeypotd](https://github.com/sjinks/mysql-honeypotd) - C 编写的低交互 MySQL 蜜罐 34 | - [MysqlPot](https://github.com/schmalle/MysqlPot) - MySQL 蜜罐 35 | - [pghoney](https://github.com/betheroot/pghoney) - 低交互 Postgres 蜜罐 36 | - [sticky_elephant](https://github.com/betheroot/sticky_elephant) - 中交互 postgresql 蜜罐 37 | 38 | - Web 蜜罐 39 | - [Bukkit Honeypot](https://github.com/Argomirr/Honeypot) Honeypot - Bukkit 的一个插件 40 | - [EoHoneypotBundle](https://github.com/eymengunay/EoHoneypotBundle) - Symfony2 类型的蜜罐 41 | - [Glastopf](https://github.com/mushorg/glastopf) - Web 应用蜜罐 42 | - [Google Hack Honeypot](http://ghh.sourceforge.net) - 旨在提供针对那些使用搜索引擎探测资源的攻击者的侦察 43 | - [Laravel Application Honeypot](https://github.com/msurguy/Honeypot) - Honeypot - Laravel 应用程序的简单垃圾邮件预防软件包 44 | - [Nodepot](https://github.com/schmalle/Nodepot) - NodeJS Web 应用蜜罐 45 | - [Servletpot](https://github.com/schmalle/servletpot) - Web 应用蜜罐 46 | - [Shadow Daemon](https://shadowd.zecure.org/overview/introduction/) - 用于 PHP、Perl 和 Python 应用程序的模块化Web应用程序防火墙/高交互式蜜罐 47 | - [StrutsHoneypot](https://github.com/Cymmetria/StrutsHoneypot) - 基于 Struts Apache 2 的蜜罐 48 | - [WebTrap](https://github.com/IllusiveNetworks-Labs/WebTrap) - 旨在创建欺骗性网页，重定向到真实网站 49 | - [basic-auth-pot (bap)](https://github.com/bjeborn/basic-auth-pot) bap - HTTP 基本认证蜜罐 50 | - [bwpot](https://github.com/graneed/bwpot) - Web 应用蜜罐 51 | - [django-admin-honeypot](https://github.com/dmpayton/django-admin-honeypot) - 虚假的 Django 管理登录页面，记录未经授权的访问尝试 52 | - [drupo](https://github.com/d1str0/drupot) - Drupal 蜜罐 53 | - [honeyhttpd](https://github.com/bocajspear1/honeyhttpd) - 基于 Python 的 Web 服务器蜜罐构建工具 54 | - [phpmyadmin_honeypot](https://github.com/gfoss/phpmyadmin_honeypot) - - 简单有效的 phpMyAdmin 蜜罐 55 | - [shockpot](https://github.com/threatstream/shockpot) - 检测 Shell Shock 利用尝试的 Web 应用蜜罐 56 | - [smart-honeypot](https://github.com/freak3dot/smart-honeypot) - PHP 脚本编写的智能蜜罐 57 | - Snare/Tanner - Glastopf 的后继者 58 | - [Snare](https://github.com/mushorg/snare) - 下一代高交互 honEypot 59 | - [Tanner](https://github.com/mushorg/tanner) - 评估 SNARE 事件 60 | - [stack-honeypot](https://github.com/CHH/stack-honeypot) - 将针对垃圾邮件机器人的陷阱插入到响应中 61 | - [tomcat-manager-honeypot](https://github.com/helospark/tomcat-manager-honeypot) - Tomcat 蜜罐。记录请求并保存攻击者的 WAR 文件 62 | - WordPress honeypots 63 | - [HonnyPotter](https://github.com/MartinIngesen/HonnyPotter) - WordPress 的登录蜜罐，用于收集和分析失败的登录尝试 64 | - [HoneyPress](https://github.com/dustyfresh/HoneyPress) - Docker 容器中基于 Python 的 WordPress 蜜罐 65 | - [wp-smart-honeypot](https://github.com/freak3dot/wp-smart-honeypot) - 减少垃圾邮件的 WordPress 插件 66 | - [wordpot](https://github.com/gbrindisi/wordpot) - WordPress 蜜罐 67 | 68 | - 服务蜜罐 69 | - [ADBHoney](https://github.com/huuck/ADBHoney) - 安卓低交互蜜罐. 70 | - [AMTHoneypot](https://github.com/packetflare/amthoneypot) - 针对 Intel 的 AMT 固件漏洞（CVE-2017-5689）的蜜罐 71 | - [Ensnare](https://github.com/ahoernecke/ensnare) - 易部署的 Ruby 蜜罐 72 | - [HoneyPy](https://github.com/foospidy/HoneyPy) - 低交互蜜罐 73 | - [Honeygrove](https://github.com/UHH-ISS/honeygrove) - 基于 Twisted 的多用途、模块化蜜罐 74 | - [Honeyport](https://github.com/securitygeneration/Honeyport) - Bash 和 Python 写成的简单 honeyport 75 | - [Honeyprint](https://github.com/glaslos/honeyprint) - 打印机蜜罐 76 | - [Lyrebird](https://hub.docker.com/r/lyrebird/honeypot-base/) - 现代高交互蜜罐框架 77 | - [MICROS honeypot](https://github.com/Cymmetria/micros_honeypot) - 在带有 Oracle Hospitality Simphony 的 Oracle Hospitality Applications (MICROS) 中检测 CVE-2018-2636 的低交互蜜罐 78 | - [RDPy](https://github.com/citronneur/rdpy) - Python 实现的 RDP 蜜罐 79 | - [SMB Honeypot](https://github.com/r0hi7/HoneySMB) - 可以捕获类似 Wannacry 的恶意软件的高交互 SMB 蜜罐 80 | - [Tom's Honeypot](https://github.com/inguardians/toms_honeypot) - 低交互 Python 蜜罐 81 | - [WebLogic honeypot](https://github.com/Cymmetria/weblogic_honeypot) - 在带有 Oracle WebLogic Server 的 Oracle Fusion Middleware 中检测 CVE-2017-10271 的低交互蜜罐 82 | - [WhiteFace Honeypot](https://github.com/csirtgadgets/csirtg-honeypot) - 基于 Twisted 开发的针对 WhiteFace 蜜罐 83 | - [honeycomb_plugins](https://github.com/Cymmetria/honeycomb_plugins) - Honeycomb 插件仓库，Cymmetria 的蜜罐框架 84 | - [honeyntp](https://github.com/fygrave/honeyntp) - NTP 蜜罐 85 | - [honeypot-camera](https://github.com/alexbredo/honeypot-camera) - 相机蜜罐 86 | - [honeypot-ftp](https://github.com/alexbredo/honeypot-ftp) - FTP 蜜罐 87 | - [honeytrap](https://github.com/honeytrap/honeytrap) - 用 Go 编写的高级蜜罐框架，可以连接其他蜜罐 88 | - [pyrdp](https://github.com/gosecure/pyrdp) - Python 3 实现的 RDP 中间人库，能监视连接 89 | - [troje](https://github.com/dutchcoders/troje/) - 围绕 LXC 容器的蜜罐，将每一个服务的连接都放到单独的 LXC 容器内 90 | 91 | - 分布式蜜罐 92 | - [DemonHunter](https://github.com/RevengeComing/DemonHunter) - 低交互蜜罐服务器 93 | 94 | - 反蜜罐 95 | - [kippo_detect](https://github.com/andrew-morris/kippo_detect) - 检测 Kippo 蜜罐 96 | 97 | - ICS/SCADA 蜜罐 98 | - [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA 蜜罐 99 | - [GasPot](https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, 常见于石油、天然气行业 100 | - [SCADA honeynet](http://scadahoneynet.sourceforge.net) - 建立工业网络的蜜罐 101 | - [gridpot](https://github.com/sk4ld/gridpot) - 模拟实际电网的开源蜜罐 102 | - [scada-honeynet](http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/) - 模拟流行的 PLC 服务，更好地帮助 SCADA 研究人员了解暴露的控制系统设备的潜在风险 103 | 104 | - 其他/随机 105 | - [DSHP](https://github.com/naorlivne/dshp) - 带有插件化支持的简单蜜罐 106 | - [NOVA](https://github.com/DataSoft/Nova) 看起来像完整系统的蜜罐 107 | - [OpenFlow Honeypot（OFPot）](https://github.com/upa/ofpot) - 基于 POX 的 OpenFlow 蜜罐，将未使用的IP地址的流量重定向到蜜罐中 108 | - [OpenCanary](https://pypi.org/project/opencanary/) - 模块化、分布式蜜罐 109 | - [ciscoasa_honeypot](https://github.com/cymmetria/ciscoasa_honeypot) 用于思科 ASA 低交互蜜罐，检测 CVE-2018-0101 远程代码执行漏洞 110 | - [miniprint](https://github.com/sa7mon/miniprint) - 打印机中交互蜜罐 111 | 112 | - 僵尸网络 C&C 工具 113 | - [Hale](https://github.com/pjlantz/Hale) - 僵尸网络 C&C 监视器 114 | - [dnsMole](https://code.google.com/archive/p/dns-mole/) - 分析 DNS 流量，检测潜在的僵尸网络 C&C 服务器和受感染的主机 115 | 116 | - IPv6 攻击检测工具 117 | - [ipv6-attack-detector](https://github.com/mzweilin/ipv6-attack-detector/) - Honeynet 项目支持的 Googel Summer of Code 2012 项目 118 | 119 | - 动态代码检查工具包 120 | - [Frida](https://www.frida.re) - 注入 JavaScript 来探索Windows、Mac、Linux、iOS 和 Android 上的应用程序 121 | 122 | - 将网站转换为服务器蜜罐 123 | - [HIHAT](http://hihat.sourceforge.net/) - 将任意 PHP 页面转换成基于 Web 的高交互蜜罐 124 | 125 | - 恶意软件收集 126 | - [Kippo-Malware](https://bruteforcelab.com/kippo-malware) - 用于在 Kippo SSH 蜜罐数据库中记录的 URL 上下载恶恶意文件的 Python 脚本 127 | 128 | - 分布式传感器部署 129 | - [Modern Honey Network](https://github.com/threatstream/mhn) - 分布式 Snort 与蜜罐传感器管理，使用虚拟网络，最小指纹的 SNORT 安装，服务器提供隐形侦察与集中管理 130 | 131 | - 网络分析工具 132 | - [Tracexploit](https://code.google.com/archive/p/tracexploit/) - 重放网络数据包 133 | 134 | - 日志匿名工具 135 | - [LogAnon](http://code.google.com/archive/p/loganon/) - 日志匿名库 136 | 137 | - 低交互蜜罐（路由器后门） 138 | - [Honeypot-32764](https://github.com/knalli/honeypot-for-tcp-32764) - 路由器后门蜜罐(TCP 32764). 139 | - [WAPot](https://github.com/lcashdol/WAPot) - 能够观察家庭路由器流量的蜜罐 140 | 141 | - HTTPS 代理 142 | - [mitmproxy](https://mitmproxy.org/) - 拦截、检查、修改、重放流量 143 | 144 | - 系统插桩 145 | - [Sysdig](https://sysdig.com/opensource/) - 捕获 Linux 系统的状态与活动，可以进行保存、过滤与分析的开源系统级探索工具 146 | - [Fibratus](https://github.com/rabbitstack/fibratus) - 用于探索和跟踪 Windows 内核的工具 147 | 148 | - 检测 USB 恶意传播的蜜罐 149 | - [Ghost-usb](https://github.com/honeynet/ghost-usb-honeypot) - 检测通过 USB 存储设备传播恶意软件的蜜罐 150 | 151 | - 数据采集 152 | - [Kippo2MySQL](https://bruteforcelab.com/kippo2mysql) - 从 Kippo 的日志文件中提取一些基本的统计信息插入到数据库中 153 | - [Kippo2ElasticSearch](https://bruteforcelab.com/kippo2elasticsearch) - 用于将 Kippo SSH 蜜罐数据从 MySQL 数据库传输到 ElasticSearch 实例（服务器或集群）的 Python 脚本 154 | 155 | - 被动网络审计框架解析工具 156 | - [Passive Network Audit Framework（pnaf）](https://github.com/jusafing/pnaf) - 被动网络审计框架 157 | 158 | - 虚拟机监控工具 159 | - [Antivmdetect](https://github.com/nsmfoo/antivmdetection) - 用于创建 VirtualBox 虚拟机模版的脚本，使检测虚拟机更困难 160 | - [VMCloak](https://github.com/hatching/vmcloak) - Cuckoo 沙盒的自动虚拟机生成和隐藏 161 | - [vmitools](http://libvmi.com/) - 带有 Python 接口的 C 库，可以轻松监视运行中的虚拟机的底层细节 162 | 163 | - 二进制调试器 164 | - [Hexgolems - Pint Debugger Backend](https://github.com/hexgolems/pint) - 一个调试器后端与 Pin 的 Lua 接口 165 | - [Hexgolems - Schem Debugger Frontend](https://github.com/hexgolems/schem) - 一个调试器前端 166 | 167 | - 移动应用分析工具 168 | - [Androguard](https://github.com/androguard/androguard) - 安卓应用程序逆向工程工具 169 | - [APKinspector](https://github.com/honeynet/apkinspector/) - 带有界面的安卓应用程序分析工具 170 | 171 | - 低交互蜜罐 172 | - [Honeyperl](https://sourceforge.net/projects/honeyperl/) - 基于 Perl 的蜜罐，有很多插件 173 | - [T-Pot](https://github.com/dtag-dev-sec/tpotce) - 为电信服务商 T-Mobile 提供的蜜罐 174 | 175 | - 蜜罐数据融合 176 | - [HFlow2](https://projects.honeynet.org/hflow) - 用于蜜罐/网络分析的数据融合工具 177 | 178 | - 服务器 179 | - [Amun](http://amunhoney.sourceforge.net) - 漏洞模拟蜜罐 180 | - [Artillery](https://github.com/trustedsec/artillery/) - 开源蓝队工具，旨在通过多种办法保护 Linux 和 Windows 操作系统 181 | - [Bait and Switch](http://baitnswitch.sourceforge.net) - 将恶意流量重定向到生产系统镜像的蜜罐 182 | - [Bifrozt](https://github.com/Ziemeck/bifrozt-ansible) - 自动部署带有 ansible 的 bifrozt 183 | - [Conpot](http://conpot.org/) - 低交互的工业控制系统蜜罐 184 | - [Heralding](https://github.com/johnnykv/heralding) - 捕获凭据的蜜罐 185 | - [HoneyWRT](https://github.com/CanadianJeff/honeywrt) - 基于 Python 的低交互蜜罐，旨在模拟攻击者可能攻击的服务或端口 186 | - [Honeyd](https://github.com/provos/honeyd) 请查看[更多 honeyd 工具](#honeyd) 187 | - [Honeysink](http://www.honeynet.org/node/773) - 开源网络陷阱，提供了检测与阻止指定网络上恶意流量的机制 188 | - [Hontel](https://github.com/stamparm/hontel) - Telnet 蜜罐 189 | - [KFSensor](http://www.keyfocus.net/kfsensor/) - 基于 Windows 的入侵检测系统蜜罐 190 | - [LaBrea](http://labrea.sourceforge.net/labrea-info.html) - 接管未使用的 IP 地址，创建对蠕虫、黑客有吸引力的虚拟服务 191 | - [MTPot](https://github.com/Cymmetria/MTPot) - 专注于 Mirai 的开源 Telnet 蜜罐 192 | - [SIREN](https://github.com/blaverick62/SIREN) - 半智能蜜罐网络 - 蜜网只能虚拟环境 193 | - [TelnetHoney](https://github.com/balte/TelnetHoney) - 简单的 telnet 蜜罐 194 | - [UDPot Honeypot](https://github.com/jekil/UDPot) - 简单 UDP / DNS 蜜罐脚本 195 | - [Yet Another Fake Honeypot (YAFH)](https://github.com/fnzv/YAFH) - 使用 Go 编写的简单蜜罐 196 | - [arctic-swallow](https://github.com/ajackal/arctic-swallow) - 低交互蜜罐 197 | - [glutton](https://github.com/mushorg/glutton) - 可喂食蜜罐 198 | - [go-HoneyPot](https://github.com/Mojachieee/go-HoneyPot) - 使用 Go 编写的蜜罐 199 | - [go-emulators](https://github.com/kingtuna/go-emulators) - Go 蜜罐模拟器 200 | - [honeymail](https://github.com/sec51/honeymail) - 使用 Go 编写的 SMTP 蜜罐 201 | - [honeytrap](https://github.com/tillmannw/honeytrap) - 一个用于捕获针对 TCP 和 UDP 服务攻击的低交互蜜罐 202 | - [imap-honey](https://github.com/yvesago/imap-honey) - 使用 Go 编写的 IMAP 蜜罐 203 | - [mwcollectd](https://www.openhub.net/p/mwcollectd) - 联合 nepenthes 和 honeytrap 的最佳功能实现的多功能恶意软件收集蜜罐 204 | - [potd](https://github.com/lnslbrty/potd) - 使用 Linux 的 Namespaces、Seccomp 与 Capabilities 构建针对 OpenWrt/IoT 设备的低中交互 SSH/TCP 蜜罐 205 | - [portlurker](https://github.com/bartnv/portlurker) - 用于协议猜测和安全字符显示的端口监听工具/蜜罐 206 | - [slipm-honeypot](https://github.com/rshipp/slipm-honeypot) - 简单的低交互端口监听蜜罐 207 | - [telnet-iot-honeypot](https://github.com/Phype/telnet-iot-honeypot) - 为了捕获僵尸网络二进制文件，使用 Python 编写的 telnet 蜜罐 208 | - [telnetlogger](https://github.com/robertdavidgraham/telnetlogger) - 跟踪 Mirai 的 Telnet 蜜罐 209 | - [vnclowpot](https://github.com/magisterquis/vnclowpot) - 低交互的 VNC 蜜罐 210 | 211 | - IDS 签名生成 212 | - [Honeycomb](http://www.icir.org/christian/honeycomb/) - 使用蜜罐自动创建签名 213 | 214 | - 查找服务提供商的 ASN 与前缀 215 | - [CC2ASN](http://www.cc2asn.com/) - 简单的查询服务 216 | 217 | - 数据收集/数据共享 218 | - [HPFeeds](https://github.com/rep/hpfeeds/) - 轻量认证的订阅发布协议 219 | 220 | - 集中管理工具 221 | - [PHARM](http://www.nepenthespharm.com/) - 管理、统计、分析你的分布式 Nepenthes 蜜罐 222 | 223 | - 网络连接分析工具 224 | - [Impost](http://impost.sourceforge.net/) - 网络安全审计工具，用于取证分析被破坏/易受攻击的守护进程 225 | 226 | - 蜜罐部署 227 | - [Modern Honeynet Network](http://threatstream.github.io/mhn/) - 让蜜罐的管理与部署更简单 228 | 229 | - Wireshark 的蜜罐扩展 230 | - [Whireshark Extensions](https://www.honeynet.org/project/WiresharkExtensions) - 支持应用针对 PCAP 文件的 Snort IDS 规则与签名 231 | 232 | - 客户端蜜罐 233 | - [CWSandbox / GFI Sandbox](https://www.gfi.com/products-and-solutions/all-products) 234 | - [Capture-HPC-Linux](https://redmine.honeynet.org/projects/linux-capture-hpc/wiki) 235 | - [Capture-HPC-NG](https://github.com/CERT-Polska/HSN-Capture-HPC-NG) 236 | - [Capture-HPC](https://projects.honeynet.org/capture-hpc) - 高交互客户端蜜罐 237 | - [HoneyBOT](http://www.atomicsoftwaresolutions.com/) 238 | - [HoneyC](https://projects.honeynet.org/honeyc) 239 | - [HoneySpider Network](https://github.com/CERT-Polska/hsn2-bundle) - 集成多个客户端蜜罐检测恶意网站的可扩展系统 240 | - [HoneyWeb](https://code.google.com/archive/p/gsoc-honeyweb/) - 为管理与远程共享 Honeyclients 资源而创建的 Web 界面 241 | - [Jsunpack-n](https://github.com/urule99/jsunpack-n) 242 | - [MonkeySpider](http://monkeyspider.sourceforge.net) 243 | - [PhoneyC](https://github.com/honeynet/phoneyc) 244 | - [Pwnypot](https://github.com/shjalayeri/pwnypot) - 高交互客户端蜜罐 245 | - [Rumal](https://github.com/thugs-rumal/) 246 | - [Shelia](https://www.cs.vu.nl/~herbertb/misc/shelia/) 247 | - [Thug](https://buffer.github.io/thug/) 248 | - [Thug Distributed Task Queuing](https://thug-distributed.readthedocs.io/en/latest/index.html) 249 | - [Trigona](https://www.honeynet.org/project/Trigona) 250 | - [URLQuery](https://urlquery.net/) 251 | - [YALIH (Yet Another Low Interaction Honeyclient)](https://github.com/Masood-M/yalih) - 低交互客户端蜜罐，旨在通过签名，异常和模式匹配技术检测恶意网站 252 | 253 | - 蜜罐 254 | - [Deception Toolkit](http://www.all.net/dtk/dtk.html) 255 | - [IMHoneypot](https://github.com/mushorg/imhoneypot) 256 | 257 | - PDF 文档检查工具 258 | - [peepdf](https://github.com/jesparza/peepdf) 259 | 260 | - 混合低/高交互蜜罐 261 | - [HoneyBrid](http://honeybrid.sourceforge.net) 262 | 263 | - SSH 蜜罐 264 | - [Blacknet](https://github.com/morian/blacknet) - SSH 蜜罐系统 265 | - [Cowrie](https://github.com/cowrie/cowrie) - Cowrie SSH 蜜罐 (基于 kippo) 266 | - [DShield docker](https://github.com/xme/dshield-docker) - 启用了 DShield 输出的 Docker 容器 267 | - [HonSSH](https://github.com/tnich/honssh) - 记录客户端与服务器之间所有 SSH 通信 268 | - [HUDINX](https://github.com/Cryptix720/HUDINX) - 用于记录暴力破解的低交互 SSH 蜜罐，记录攻击者全部 Shell 交互 269 | - [Kojoney](http://kojoney.sourceforge.net/) 270 | - [Kojoney2](https://github.com/madirish/kojoney2) - 根据 Kojoney 用 Python 编写的低交互 SSH 蜜罐 271 | - [Kippo](https://github.com/desaster/kippo) - 中交互 SSH 蜜罐 272 | - [Kippo_JunOS](https://github.com/gregcmartin/Kippo_JunOS) - 基于 Kippo 的蜜罐 273 | - [Kojoney2](https://github.com/madirish/kojoney2) - Jose Antonio Coret 使用 Python 编写，基于 Kojoney 的低交互 SSH 蜜罐 274 | - [Kojoney](http://kojoney.sourceforge.net/) - 基于 Python 的低交互蜜罐，使用 Twisted Conch 模拟 SSH 服务 275 | - [LongTail Log Analysis @ Marist College](http://longtail.it.marist.edu/honey/) - 分析 SSH 蜜罐日志 276 | - [Malbait](https://github.com/batchmcnulty/Malbait) - 使用 Perl 实现的 TCP/UDP 蜜罐 277 | - [MockSSH](https://github.com/ncouture/MockSSH) - 支持定义的所有命令的 SSH 服务器 278 | - [cowrie2neo](https://github.com/xlfe/cowrie2neo) - 解析 cowrie 蜜罐日志到 neo4j 数据库 279 | - [go-sshoney](https://github.com/ashmckenzie/go-sshoney) - SSH 蜜罐 280 | - [go0r](https://github.com/fzerorubigd/go0r) - 使用 Go 编写的简单 SSH 蜜罐 281 | - [gohoney](https://github.com/PaulMaddox/gohoney) - 使用 Go 编写的 SSH 蜜罐 282 | - [hived](https://github.com/sahilm/hived) - 基于 Go 编写的蜜罐 283 | - [hnypots-agent)](https://github.com/joshrendek/hnypots-agent) - 记录用户名和密码组合的 SSH 服务器 284 | - [honeypot.go](https://github.com/mdp/honeypot.go) - 使用 Go 编写的 SSH 蜜罐 285 | - [honeyssh](https://github.com/ppacher/honeyssh) - 凭据 dumping 的 SSH 蜜罐 286 | - [hornet](https://github.com/czardoz/hornet) - 支持多虚拟主机的中交互 SSH 蜜罐 287 | - [ssh-auth-logger](https://github.com/JustinAzoff/ssh-auth-logger) - 低\零交互 SSH 蜜罐 288 | - [ssh-honeypot](https://github.com/droberson/ssh-honeypot) - 伪造 SSHD，记录 IP 地址、用户名与密码 289 | - [ssh-honeypot](https://github.com/amv42/sshd-honeypot) - OpenSSH DEAMON 的改版，将命令转发到 Cowrie 290 | - [ssh-honeypotd](https://github.com/sjinks/ssh-honeypotd) - C 编写的低交互 SSH 蜜罐 291 | - [sshForShits](https://github.com/traetox/sshForShits) - 高交互 SSH 蜜罐框架 292 | - [sshesame](https://github.com/jaksi/sshesame) - 记录登录活动的虚假 SSH 服务器 293 | - [sshhipot](https://github.com/magisterquis/sshhipot) - 高交互中间人 SSH 蜜罐 294 | - [sshlowpot](https://github.com/magisterquis/sshlowpot) - Go 编写的低交互 SSH 蜜罐 295 | - [sshsyrup](https://github.com/mkishere/sshsyrup) - 简单的 SSH 蜜罐，捕获终端活动并上传到 asciinema.org 296 | - [twisted-honeypots](https://github.com/lanjelot/twisted-honeypots) - 基于 Twisted 的 SSH\FTP\Telnet 的蜜罐 297 | 298 | - 分布式传感器项目 299 | - [DShield Web Honeypot Project](https://sites.google.com/site/webhoneypotsite/) 300 | 301 | - PCAP 分析工具 302 | - [Honeysnap](https://projects.honeynet.org/honeysnap/) 303 | 304 | - 网络流量重定向工具 305 | - [Honeywall](https://projects.honeynet.org/honeywall/) 306 | 307 | - 混合内容的分布式蜜罐 308 | - [HoneyDrive](https://bruteforcelab.com/honeydrive) 309 | 310 | - 蜜罐传感器 311 | - [Honeeepi](https://redmine.honeynet.org/projects/honeeepi/wiki) - Raspberry Pi 上一款基于定制 Raspbian 操作系统的蜜罐 312 | 313 | - File carving 314 | - [TestDisk & PhotoRec](https://www.cgsecurity.org/) 315 | 316 | - Windows 可用的行为分析工具 317 | - [Capture BAT](https://www.honeynet.org/node/315) 318 | 319 | - Live CD 320 | - [DAVIX](https://www.secviz.org/node/89) - DAVIX Released 321 | 322 | - Spamtrap 323 | - [Mail::SMTP::Honeypot](https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - 提供标准 SMTP 服务器工具的 Perl 模块 324 | - [Mailoney](https://github.com/awhitehatter/mailoney) - Python 编写的 SMTP 蜜罐，具有开放中继、凭据记录等功能 325 | - [SendMeSpamIDS.py](https://github.com/johestephan/VerySimpleHoneypot) - 获得所有 IDS 和分析设备的简单 SMTP 326 | - [Shiva](https://github.com/shiva-spampot/shiva) - 垃圾邮件蜜罐与智能分析工具 327 | - [Shiva The Spam Honeypot Tips And Tricks For Getting It Up And Running](https://www.pentestpartners.com/security-blog/shiva-the-spam-honeypot-tips-and-tricks-for-getting-it-up-and-running/) 328 | - [SpamHAT](https://github.com/miguelraulb/spamhat) - 垃圾邮件蜜罐工具 329 | - [Spamhole](http://www.spamhole.net/) 330 | - [honeypot](https://github.com/jadb/honeypot) - 蜜罐项目组非官方 PHP 的 SDK 331 | - [spamd](http://man.openbsd.org/cgi-bin/man.cgi?query=spamd%26apropos=0%26sektion=0%26manpath=OpenBSD+Current%26arch=i386%26format=html) 332 | 333 | - 商业蜜网 334 | - [Cymmetria Mazerunner](https://cymmetria.com/products/mazerunner/) - 可引导攻击者远离真实目标，并创建攻击痕迹跟踪 335 | 336 | - 服务器（蓝牙） 337 | - [Bluepot](https://github.com/andrewmichaelsmith/bluepot) 338 | 339 | - Android 应用程序动态分析 340 | - [Droidbox](https://code.google.com/archive/p/droidbox/) 341 | 342 | - Docker 化的低交互蜜罐 343 | - [Docker honeynet](https://github.com/sreinhardt/Docker-Honeynet) - 部署与 Docker 容器中的一些蜜网工具 344 | - [Dockerized Thug](https://hub.docker.com/r/honeynet/thug/) - 基于 [Thug](https://github.com/buffer/thug) 的 Docker 蜜罐，用于分析恶意 Web 内容 345 | - [Dockerpot](https://github.com/mrschyte/dockerpot) - 基于 Docker 的蜜罐 346 | - [Manuka](https://github.com/andrewmichaelsmith/manuka) - 基于 Docker 的蜜罐 (Dionaea & Kippo). 347 | - [mhn-core-docker](https://github.com/MattCarothers/mhn-core-docker) - 在 Docker 中实现的现代蜜网核心元素 348 | 349 | - 网络分析 350 | - [Quechua](https://bitbucket.org/zaccone/quechua) 351 | 352 | - SIP Server 353 | - [Artemnesia VoIP](http://artemisa.sourceforge.net) 354 | 355 | - IOT 蜜罐 356 | - [HoneyThing](https://github.com/omererdem/honeything) - TR-069 蜜罐 357 | - [Kako](https://github.com/darkarnium/kako) - 常见嵌入式设备漏洞的蜜罐 358 | 359 | - Honeytokens 360 | - [CanaryTokens](https://github.com/thinkst/canarytokens) - Honeytoken 生成器，Dashboard 在 [CanaryTokens.org](https://canarytokens.org/generate) 361 | - [Honeybits](https://github.com/0x4D31/honeybits) - 旨在通过在生产服务器和工作站中传播 breadcrumbs 和 honeytokens 来诱使攻击者进入蜜罐，从而提高诱捕率 362 | - [Honeyλ (HoneyLambda)](https://github.com/0x4D31/honeylambda) - 简单的无服务器应用程序，旨在创建和监控 AWS Lambda 和 Amazon API Gateway 之上的网址 honeytokens 363 | - [dcept](https://github.com/secureworks/dcept) - 部署、检测活动目录使用情况的 honeytokens 364 | - [honeyku](https://github.com/0x4D31/honeyku) - 基于 Heroku 的 Web 蜜罐 365 | 366 | 367 | ## Honeyd 工具 368 | 369 | - Honeyd 插件 370 | - [Honeycomb](http://www.honeyd.org/tools.php) 371 | 372 | - Honeyd 查看工具 373 | - [Honeyview](http://honeyview.sourceforge.net/) 374 | 375 | - Honeyd 与 MySQL 的连接 376 | - [Honeyd2MySQL](https://bruteforcelab.com/honeyd2mysql) 377 | 378 | - Honeyd 统计数据可视化脚本 379 | - [Honeyd-Viz](https://bruteforcelab.com/honeyd-viz) 380 | 381 | - Honeyd 统计 382 | - [Honeydsum.pl](https://github.com/DataSoft/Honeyd/blob/master/scripts/misc/honeydsum-v0.3/honeydsum.pl) 383 | 384 | 385 | ## 网络与行为分析 386 | 387 | - 沙盒 388 | - [Argos](http://www.few.vu.nl/argos/) - 用于捕获零日攻击的模拟器 389 | - [COMODO automated sandbox](https://help.comodo.com/topic-72-1-451-4768-.html) 390 | - [Cuckoo](https://cuckoosandbox.org/) - 领先的开源自动化恶意软件分析系统 391 | - [Pylibemu](https://github.com/buffer/pylibemu) - Libemu Cython 392 | - [RFISandbox](https://monkey.org/~jose/software/rfi-sandbox/) - 使用 PHP 5.x 脚本在 [funcall](https://pecl.php.net/package/funcall) 上构建的沙盒 393 | - [dorothy2](https://github.com/m4rco-/dorothy2) - Ruby 编写的恶意软件/僵尸网络分析框架 394 | - [imalse](https://github.com/hbhzwj/imalse) - 集成的恶意软件仿真工具与模拟工具 395 | - [libemu](https://github.com/buffer/libemu) - Shellcode 模拟库，对 Shellcode 检测十分有用 396 | 397 | - 沙盒即服务 398 | - [Hybrid Analysis](https://www.hybrid-analysis.com) - 由 Payload Security 提供的免费恶意软件分析服务，可使用其独特的混合分析技术检测和分析未知威胁 399 | - [Joebox Cloud](https://jbxcloud.joesecurity.org/login) - 确定 Windows、Android 和 Mac OS X 上的恶意文件（包括 PE、PDF、DOC、PPT、XLS、APK、URL 和 MachO）的行为，判断其是否存在可疑活动 400 | - [VirusTotal](https://www.virustotal.com/) 401 | - [malwr.com](https://malwr.com/) - 提供免费恶意软件分析服务与社区 402 | 403 | 404 | ## 数据分析工具 405 | 406 | - 前端 407 | - [DionaeaFR](https://github.com/rubenespadas/DionaeaFR) - Dionaea 蜜罐前端 Web 408 | - [Django-kippo](https://github.com/jedie/django-kippo) - 用于 kippo SSH 蜜罐的 Django 程序 409 | - [Shockpot-Frontend](https://github.com/GovCERT-CZ/Shockpot-Frontend) - 用于可视化 Shockpot 蜜罐中数据的脚本 410 | - [Tango](https://github.com/aplura/Tango) - 使用 Splunk 处理蜜罐情报 411 | - [Wordpot-Frontend](https://github.com/GovCERT-CZ/Wordpot-Frontend) - 用于可视化 Wordpot 蜜罐中数据的脚本 412 | - [honeyalarmg2](https://github.com/schmalle/honeyalarmg2) - 用于显示蜜罐数据的简化 UI 413 | - [honeypotDisplay](https://github.com/Joss-Steward/honeypotDisplay) - 展示 SSH 蜜罐的 Flask 网站 414 | 415 | - 可视化 416 | - [Acapulco](https://github.com/hgascon/acapulco) - 自动攻击群体图构建 417 | - [Afterglow Cloud](https://github.com/ayrus/afterglow-cloud) 418 | - [Afterglow](http://afterglow.sourceforge.net/) 419 | - [Glastopf Analytics](https://github.com/katkad/Glastopf-Analytics) - 简单蜜罐统计 420 | - [HoneyMalt](https://github.com/SneakersInc/HoneyMalt) - Maltego 转换映射蜜罐系统 421 | - [HoneyMap](https://github.com/fw42/honeymap) - 显示实时 Websocket 流的 SVG 地图 422 | - [HoneyStats](https://sourceforge.net/projects/honeystats/) - Honeynet 的统计视图 423 | - [HpfeedsHoneyGraph](https://github.com/yuchincheng/HpfeedsHoneyGraph) - 可视化 hpfeeds 日志的程序 424 | - [Kippo stats](https://github.com/mfontani/kippo-stats) - 为 kippo SSH 蜜罐展示数据的程序 425 | - [Kippo-Graph](https://bruteforcelab.com/kippo-graph) - 用于可视化 Kippo 蜜罐中数据的脚本 426 | - [The Intelligent HoneyNet](https://github.com/jpyorre/IntelligentHoneyNet) - 试图创建蜜罐中可操作信息的智能蜜网项目 427 | - [ovizart](https://github.com/oguzy/ovizart) - 可视化网络流量分析 428 | 429 | 430 | ## 指南 431 | 432 | - [T-Pot: 多蜜罐平台](https://dtag-dev-sec.github.io/mediator/feature/2015/03/17/concept.html) 433 | - [蜜罐 (Dionaea and kippo) 设置脚本](https://github.com/andrewmichaelsmith/honeypot-setup-script/) 434 | 435 | - 部署 436 | - [Dionaea and EC2 in 20 Minutes](http://andrewmichaelsmith.com/2012/03/dionaea-honeypot-on-ec2-in-20-minutes/) - 在 EC2 上设置 Dionaea 的教程 437 | - [Using a Raspberry Pi honeypot to contribute data to DShield/ISC](https://isc.sans.edu/diary/22680) - 基于 Raspberry Pi 的系统可以收集比防火墙日志更丰富的日志 438 | - [honeypotpi](https://github.com/free5ty1e/honeypotpi) - 将 Raspberry Pi 变成 HoneyPot Pi 的脚本 439 | 440 | - 研究论文 441 | - [Honeypot research papers](https://github.com/shbhmsingh72/Honeypot-Research-Papers) - 研究蜜罐论文的 PDF 442 | - [vEYE](https://link.springer.com/article/10.1007%2Fs10115-008-0137-3) - 自传播蠕虫行为痕迹的检测与分析 443 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Awesome Honeypots [![Awesome Honeypots](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/sindresorhus/awesome) 2 | 3 | A curated list of awesome honeypots, plus related components and much more, divided into categories such as Web, services, and others, with a focus on free and open source projects. 4 | 5 | There is no pre-established order of items in each category, the order is for contribution. If you want to contribute, please read the [guide](CONTRIBUTING.md). 6 | 7 | Discover more awesome lists at [sindresorhus/awesome](https://github.com/sindresorhus/awesome). 8 | 9 | # Contents 10 | 11 | - [Related Lists](#related-lists) 12 | - [Honeypots](#honeypots) 13 | - [Honeyd Tools](#honeyd-tools) 14 | - [Network and Artifact Analysis](#network-and-artifact-analysis) 15 | - [Data Tools](#data-tools) 16 | - [Guides](#guides) 17 | 18 | ## Related Lists 19 | 20 | - [awesome-pcaptools](https://github.com/caesar0301/awesome-pcaptools) - Useful in network traffic analysis. 21 | - [awesome-malware-analysis](https://github.com/rshipp/awesome-malware-analysis) - Some overlap here for artifact analysis. 22 | 23 | ## Honeypots 24 | 25 | - Database Honeypots 26 | - [Delilah](https://github.com/SecurityTW/delilah) - Elasticsearch Honeypot written in Python (originally from Novetta). 27 | - [ESPot](https://github.com/mycert/ESPot) - Elasticsearch honeypot written in NodeJS, to capture every attempts to exploit CVE-2014-3120. 28 | - [Elastic honey](https://github.com/jordan-wright/elastichoney) - Simple Elasticsearch Honeypot. 29 | - [HoneyMysql](https://github.com/xiaoxiaoleo/HoneyMysql) - Simple Mysql honeypot project. 30 | - [MongoDB-HoneyProxy](https://github.com/Plazmaz/MongoDB-HoneyProxy) - MongoDB honeypot proxy. 31 | - [MongoDB-HoneyProxyPy](https://github.com/jwxa2015/MongoDB-HoneyProxyPy) - MongoDB honeypot proxy by python3. 32 | - [NoSQLpot](https://github.com/torque59/nosqlpot) - Honeypot framework built on a NoSQL-style database. 33 | - [mysql-honeypotd](https://github.com/sjinks/mysql-honeypotd) - Low interaction MySQL honeypot written in C. 34 | - [MysqlPot](https://github.com/schmalle/MysqlPot) - MySQL honeypot, still very early stage. 35 | - [pghoney](https://github.com/betheroot/pghoney) - Low-interaction Postgres Honeypot. 36 | - [sticky_elephant](https://github.com/betheroot/sticky_elephant) - Medium interaction postgresql honeypot. 37 | 38 | - Web honeypots 39 | - [EoHoneypotBundle](https://github.com/eymengunay/EoHoneypotBundle) - Honeypot type for Symfony2 forms. 40 | - [Glastopf](https://github.com/mushorg/glastopf) - Web Application Honeypot. 41 | - [Google Hack Honeypot](http://ghh.sourceforge.net) - Designed to provide reconnaissance against attackers that use search engines as a hacking tool against your resources. 42 | - [Laravel Application Honeypot](https://github.com/msurguy/Honeypot) - Simple spam prevention package for Laravel applications. 43 | - [Nodepot](https://github.com/schmalle/Nodepot) - NodeJS web application honeypot. 44 | - [Servletpot](https://github.com/schmalle/servletpot) - Web application Honeypot. 45 | - [Shadow Daemon](https://shadowd.zecure.org/overview/introduction/) - Modular Web Application Firewall / High-Interaction Honeypot for PHP, Perl, and Python apps. 46 | - [StrutsHoneypot](https://github.com/Cymmetria/StrutsHoneypot) - Struts Apache 2 based honeypot as well as a detection module for Apache 2 servers. 47 | - [WebTrap](https://github.com/IllusiveNetworks-Labs/WebTrap) - Designed to create deceptive webpages to deceive and redirect attackers away from real websites. 48 | - [basic-auth-pot (bap)](https://github.com/bjeborn/basic-auth-pot) - HTTP Basic Authentication honeypot. 49 | - [bwpot](https://github.com/graneed/bwpot) - Breakable Web applications honeyPot. 50 | - [django-admin-honeypot](https://github.com/dmpayton/django-admin-honeypot) - Fake Django admin login screen to notify admins of attempted unauthorized access. 51 | - [drupo](https://github.com/d1str0/drupot) - Drupal Honeypot. 52 | - [honeyhttpd](https://github.com/bocajspear1/honeyhttpd) - Python-based web server honeypot builder. 53 | - [phpmyadmin_honeypot](https://github.com/gfoss/phpmyadmin_honeypot) - Simple and effective phpMyAdmin honeypot. 54 | - [shockpot](https://github.com/threatstream/shockpot) - WebApp Honeypot for detecting Shell Shock exploit attempts. 55 | - [smart-honeypot](https://github.com/freak3dot/smart-honeypot) - PHP Script demonstrating a smart honey pot. 56 | - Snare/Tanner - successors to Glastopf 57 | - [Snare](https://github.com/mushorg/snare) - Super Next generation Advanced Reactive honeypot. 58 | - [Tanner](https://github.com/mushorg/tanner) - Evaluating SNARE events. 59 | - [stack-honeypot](https://github.com/CHH/stack-honeypot) - Inserts a trap for spam bots into responses. 60 | - [tomcat-manager-honeypot](https://github.com/helospark/tomcat-manager-honeypot) - Honeypot that mimics Tomcat manager endpoints. Logs requests and saves attacker's WAR file for later study 61 | - WordPress honeypots 62 | - [HonnyPotter](https://github.com/MartinIngesen/HonnyPotter) - WordPress login honeypot for collection and analysis of failed login attempts. 63 | - [HoneyPress](https://github.com/dustyfresh/HoneyPress) - Python based WordPress honeypot in a Docker container. 64 | - [wp-smart-honeypot](https://github.com/freak3dot/wp-smart-honeypot) - WordPress plugin to reduce comment spam with a smarter honeypot. 65 | - [wordpot](https://github.com/gbrindisi/wordpot) - WordPress Honeypot. 66 | 67 | - Service Honeypots 68 | - [ADBHoney](https://github.com/huuck/ADBHoney) - Low interaction honeypot that simulates an Android device running Android Debug Bridge (ADB) server process. 69 | - [AMTHoneypot](https://github.com/packetflare/amthoneypot) - Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689. 70 | - [Ensnare](https://github.com/ahoernecke/ensnare) - Easy to deploy Ruby honeypot. 71 | - [HoneyPy](https://github.com/foospidy/HoneyPy) - Low interaction honeypot. 72 | - [Honeygrove](https://github.com/UHH-ISS/honeygrove) - Multi-purpose modular honeypot based on Twisted. 73 | - [Honeyport](https://github.com/securitygeneration/Honeyport) - Simple honeyport written in Bash and Python. 74 | - [Honeyprint](https://github.com/glaslos/honeyprint) - Printer honeypot. 75 | - [Lyrebird](https://hub.docker.com/r/lyrebird/honeypot-base/) - Modern high-interaction honeypot framework. 76 | - [MICROS honeypot](https://github.com/Cymmetria/micros_honeypot) - Low interaction honeypot to detect CVE-2018-2636 in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (MICROS). 77 | - [RDPy](https://github.com/citronneur/rdpy) - Microsoft Remote Desktop Protocol (RDP) honeypot implemented in Python. 78 | - [SMB Honeypot](https://github.com/r0hi7/HoneySMB) - High interaction SMB service honeypot capable of capturing wannacry-like Malware. 79 | - [Tom's Honeypot](https://github.com/inguardians/toms_honeypot) - Low interaction Python honeypot. 80 | - [WebLogic honeypot](https://github.com/Cymmetria/weblogic_honeypot) - Low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware. 81 | - [WhiteFace Honeypot](https://github.com/csirtgadgets/csirtg-honeypot) - Twisted based honeypot for WhiteFace. 82 | - [honeycomb_plugins](https://github.com/Cymmetria/honeycomb_plugins) - Plugin repository for Honeycomb, the honeypot framework by Cymmetria. 83 | - [honeyntp](https://github.com/fygrave/honeyntp) - NTP logger/honeypot. 84 | - [honeypot-camera](https://github.com/alexbredo/honeypot-camera) - Observation camera honeypot. 85 | - [honeypot-ftp](https://github.com/alexbredo/honeypot-ftp) - FTP Honeypot. 86 | - [honeytrap](https://github.com/honeytrap/honeytrap) - Advanced Honeypot framework written in Go that can be connected with other honeypot software. 87 | - [pyrdp](https://github.com/gosecure/pyrdp) - RDP man-in-the-middle and library for Python 3 with the ability to watch connections live or after the fact. 88 | - [troje](https://github.com/dutchcoders/troje/) - Honeypot that runs each connection with the service within a seperate LXC container. 89 | 90 | - Distributed Honeypots 91 | - [DemonHunter](https://github.com/RevengeComing/DemonHunter) - Low interaction honeypot server. 92 | 93 | - Anti-honeypot stuff 94 | - [kippo_detect](https://github.com/andrew-morris/kippo_detect) - Offensive component that detects the presence of the kippo honeypot. 95 | 96 | - ICS/SCADA honeypots 97 | - [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA honeypot. 98 | - [GasPot](https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, common in the oil and gas industry. 99 | - [SCADA honeynet](http://scadahoneynet.sourceforge.net) - Building Honeypots for Industrial Networks. 100 | - [gridpot](https://github.com/sk4ld/gridpot) - Open source tools for realistic-behaving electric grid honeynets. 101 | - [scada-honeynet](http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/) - Mimics many of the services from a popular PLC and better helps SCADA researchers understand potential risks of exposed control system devices. 102 | 103 | - Other/random 104 | - [Damn Simple Honeypot (DSHP)](https://github.com/naorlivne/dshp) - Honeypot framework with pluggable handlers. 105 | - [NOVA](https://github.com/DataSoft/Nova) - Uses honeypots as detectors, looks like a complete system. 106 | - [OpenFlow Honeypot (OFPot)](https://github.com/upa/ofpot) - Redirects traffic for unused IPs to a honeypot, built on POX. 107 | - [OpenCanary](https://github.com/thinkst/opencanary) - Modular and decentralised honeypot daemon that runs several canary versions of services that alerts when a service is (ab)used. 108 | - [ciscoasa_honeypot](https://github.com/cymmetria/ciscoasa_honeypot) A low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability. 109 | - [miniprint](https://github.com/sa7mon/miniprint) - A medium interaction printer honeypot. 110 | 111 | - Botnet C2 tools 112 | - [Hale](https://github.com/pjlantz/Hale) - Botnet command and control monitor. 113 | - [dnsMole](https://code.google.com/archive/p/dns-mole/) - Analyses DNS traffic and potentionaly detect botnet command and control server activity, along with infected hosts. 114 | 115 | - IPv6 attack detection tool 116 | - [ipv6-attack-detector](https://github.com/mzweilin/ipv6-attack-detector/) - Google Summer of Code 2012 project, supported by The Honeynet Project organization. 117 | 118 | - Dynamic code instrumentation toolkit 119 | - [Frida](https://www.frida.re) - Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android. 120 | 121 | - Tool to convert website to server honeypots 122 | - [HIHAT](http://hihat.sourceforge.net/) - Transform arbitrary PHP applications into web-based high-interaction Honeypots. 123 | 124 | - Malware collector 125 | - [Kippo-Malware](https://bruteforcelab.com/kippo-malware) - Python script that will download all malicious files stored as URLs in a Kippo SSH honeypot database. 126 | 127 | - Distributed sensor deployment 128 | - [Community Honey Network](https://communityhoneynetwork.readthedocs.io/en/stable/) - CHN aims to make deployments honeypots and honeypot management tools easy and flexible. The default deployment method uses Docker Compose and Docker to deploy with a few simple commands. 129 | - [Modern Honey Network](https://github.com/threatstream/mhn) - Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management. 130 | 131 | - Network Analysis Tool 132 | - [Tracexploit](https://code.google.com/archive/p/tracexploit/) - Replay network packets. 133 | 134 | - Log anonymizer 135 | - [LogAnon](http://code.google.com/archive/p/loganon/) - Log anonymization library that helps having anonymous logs consistent between logs and network captures. 136 | 137 | - Low interaction honeypot (router back door) 138 | - [Honeypot-32764](https://github.com/knalli/honeypot-for-tcp-32764) - Honeypot for router backdoor (TCP 32764). 139 | - [WAPot](https://github.com/lcashdol/WAPot) - Honeypot that can be used to observe traffic directed at home routers. 140 | 141 | - honeynet farm traffic redirector 142 | - [Honeymole](https://web.archive.org/web/20100326040550/http://www.honeynet.org.pt:80/index.php/HoneyMole) - Deploy multiple sensors that redirect traffic to a centralized collection of honeypots. 143 | 144 | - HTTPS Proxy 145 | - [mitmproxy](https://mitmproxy.org/) - Allows traffic flows to be intercepted, inspected, modified, and replayed. 146 | 147 | - System instrumentation 148 | - [Sysdig](https://sysdig.com/opensource/) - Open source, system-level exploration allows one to capture system state and activity from a running GNU/Linux instance, then save, filter, and analyze the results. 149 | - [Fibratus](https://github.com/rabbitstack/fibratus) - Tool for exploration and tracing of the Windows kernel. 150 | 151 | - Honeypot for USB-spreading malware 152 | - [Ghost-usb](https://github.com/honeynet/ghost-usb-honeypot) - Honeypot for malware that propagates via USB storage devices. 153 | 154 | - Data Collection 155 | - [Kippo2MySQL](https://bruteforcelab.com/kippo2mysql) - Extracts some very basic stats from Kippo’s text-based log files and inserts them in a MySQL database. 156 | - [Kippo2ElasticSearch](https://bruteforcelab.com/kippo2elasticsearch) - Python script to transfer data from a Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster). 157 | 158 | - Passive network audit framework parser 159 | - [Passive Network Audit Framework (pnaf)](https://github.com/jusafing/pnaf) - Framework that combines multiple passive and automated analysis techniques in order to provide a security assessment of network platforms. 160 | 161 | - VM monitoring and tools 162 | - [Antivmdetect](https://github.com/nsmfoo/antivmdetection) - Script to create templates to use with VirtualBox to make VM detection harder. 163 | - [VMCloak](https://github.com/hatching/vmcloak) - Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox. 164 | - [vmitools](http://libvmi.com/) - C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine. 165 | 166 | - Binary debugger 167 | - [Hexgolems - Pint Debugger Backend](https://github.com/hexgolems/pint) - Debugger backend and LUA wrapper for PIN. 168 | - [Hexgolems - Schem Debugger Frontend](https://github.com/hexgolems/schem) - Debugger frontend. 169 | 170 | - Mobile Analysis Tool 171 | - [Androguard](https://github.com/androguard/androguard) - Reverse engineering, Malware and goodware analysis of Android applications and more. 172 | - [APKinspector](https://github.com/honeynet/apkinspector/) - Powerful GUI tool for analysts to analyze the Android applications. 173 | 174 | - Low interaction honeypot 175 | - [Honeyperl](https://sourceforge.net/projects/honeyperl/) - Honeypot software based in Perl with plugins developed for many functions like : wingates, telnet, squid, smtp, etc. 176 | - [T-Pot](https://github.com/dtag-dev-sec/tpotce) - All in one honeypot appliance from telecom provider T-Mobile 177 | 178 | - Honeynet data fusion 179 | - [HFlow2](https://projects.honeynet.org/hflow) - Data coalesing tool for honeynet/network analysis. 180 | 181 | - Server 182 | - [Amun](http://amunhoney.sourceforge.net) - Vulnerability emulation honeypot. 183 | - [Artillery](https://github.com/trustedsec/artillery/) - Open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods. 184 | - [Bait and Switch](http://baitnswitch.sourceforge.net) - Redirects all hostile traffic to a honeypot that is partially mirroring your production system. 185 | - [Bifrozt](https://github.com/Ziemeck/bifrozt-ansible) - Automatic deploy bifrozt with ansible. 186 | - [Conpot](http://conpot.org/) - Low interactive server side Industrial Control Systems honeypot. 187 | - [Heralding](https://github.com/johnnykv/heralding) - Credentials catching honeypot. 188 | - [HoneyWRT](https://github.com/CanadianJeff/honeywrt) - Low interaction Python honeypot designed to mimic services or ports that might get targeted by attackers. 189 | - [Honeyd](https://github.com/provos/honeyd) - See [honeyd tools](#honeyd-tools). 190 | - [Honeysink](http://www.honeynet.org/node/773) - Open source network sinkhole that provides a mechanism for detection and prevention of malicious traffic on a given network. 191 | - [Hontel](https://github.com/stamparm/hontel) - Telnet Honeypot. 192 | - [KFSensor](http://www.keyfocus.net/kfsensor/) - Windows based honeypot Intrusion Detection System (IDS). 193 | - [LaBrea](http://labrea.sourceforge.net/labrea-info.html) - Takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet. 194 | - [MTPot](https://github.com/Cymmetria/MTPot) - Open Source Telnet Honeypot, focused on Mirai malware. 195 | - [SIREN](https://github.com/blaverick62/SIREN) - Semi-Intelligent HoneyPot Network - HoneyNet Intelligent Virtual Environment. 196 | - [TelnetHoney](https://github.com/balte/TelnetHoney) - Simple telnet honeypot. 197 | - [UDPot Honeypot](https://github.com/jekil/UDPot) - Simple UDP/DNS honeypot scripts. 198 | - [Yet Another Fake Honeypot (YAFH)](https://github.com/fnzv/YAFH) - Simple honeypot written in Go. 199 | - [arctic-swallow](https://github.com/ajackal/arctic-swallow) - Low interaction honeypot. 200 | - [glutton](https://github.com/mushorg/glutton) - All eating honeypot. 201 | - [go-HoneyPot](https://github.com/Mojachieee/go-HoneyPot) - Honeypot server written in Go. 202 | - [go-emulators](https://github.com/kingtuna/go-emulators) - Honeypot Golang emulators. 203 | - [honeymail](https://github.com/sec51/honeymail) - SMTP honeypot written in Golang. 204 | - [honeytrap](https://github.com/tillmannw/honeytrap) - Low-interaction honeypot and network security tool written to catch attacks against TCP and UDP services. 205 | - [imap-honey](https://github.com/yvesago/imap-honey) - IMAP honeypot written in Golang. 206 | - [mwcollectd](https://www.openhub.net/p/mwcollectd) - Versatile malware collection daemon, uniting the best features of nepenthes and honeytrap. 207 | - [potd](https://github.com/lnslbrty/potd) - Highly scalable low- to medium-interaction SSH/TCP honeypot designed for OpenWrt/IoT devices leveraging several Linux kernel features, such as namespaces, seccomp and thread capabilities. 208 | - [portlurker](https://github.com/bartnv/portlurker) - Port listener in Rust with protocol guessing and safe string display. 209 | - [slipm-honeypot](https://github.com/rshipp/slipm-honeypot) - Simple low-interaction port monitoring honeypot. 210 | - [telnet-iot-honeypot](https://github.com/Phype/telnet-iot-honeypot) - Python telnet honeypot for catching botnet binaries. 211 | - [telnetlogger](https://github.com/robertdavidgraham/telnetlogger) - Telnet honeypot designed to track the Mirai botnet. 212 | - [vnclowpot](https://github.com/magisterquis/vnclowpot) - Low interaction VNC honeypot. 213 | 214 | 215 | - IDS signature generation 216 | - [Honeycomb](http://www.icir.org/christian/honeycomb/) - Automated signature creation using honeypots. 217 | 218 | - Lookup service for AS-numbers and prefixes 219 | - [CC2ASN](http://www.cc2asn.com/) - Simple lookup service for AS-numbers and prefixes belonging to any given country in the world. 220 | 221 | - Data Collection / Data Sharing 222 | - [HPfriends](http://hpfriends.honeycloud.net/#/home) - Honeypot data-sharing platform. 223 | - [hpfriends - real-time social data-sharing](https://heipei.io/sigint-hpfriends/) - Presentation about HPFriends feed system 224 | - [HPFeeds](https://github.com/rep/hpfeeds/) - Lightweight authenticated publish-subscribe protocol. 225 | 226 | - Central management tool 227 | - [PHARM](http://www.nepenthespharm.com/) - Manage, report, and analyze your distributed Nepenthes instances. 228 | 229 | - Network connection analyzer 230 | - [Impost](http://impost.sourceforge.net/) - Network security auditing tool designed to analyze the forensics behind compromised and/or vulnerable daemons. 231 | 232 | - Honeypot deployment 233 | - [Modern Honeynet Network](http://threatstream.github.io/mhn/) - Streamlines deployment and management of secure honeypots. 234 | 235 | - Honeypot extensions to Wireshark 236 | - [Whireshark Extensions](https://www.honeynet.org/project/WiresharkExtensions) - Apply Snort IDS rules and signatures against packet capture files using Wireshark. 237 | 238 | 239 | - Client 240 | - [CWSandbox / GFI Sandbox](https://www.gfi.com/products-and-solutions/all-products) 241 | - [Capture-HPC-Linux](https://redmine.honeynet.org/projects/linux-capture-hpc/wiki) 242 | - [Capture-HPC-NG](https://github.com/CERT-Polska/HSN-Capture-HPC-NG) 243 | - [Capture-HPC](https://projects.honeynet.org/capture-hpc) - High interaction client honeypot (also called honeyclient). 244 | - [HoneyBOT](http://www.atomicsoftwaresolutions.com/) 245 | - [HoneyC](https://projects.honeynet.org/honeyc) 246 | - [HoneySpider Network](https://github.com/CERT-Polska/hsn2-bundle) - Highly-scalable system integrating multiple client honeypots to detect malicious websites. 247 | - [HoneyWeb](https://code.google.com/archive/p/gsoc-honeyweb/) - Web interface created to manage and remotely share Honeyclients resources. 248 | - [Jsunpack-n](https://github.com/urule99/jsunpack-n) 249 | - [MonkeySpider](http://monkeyspider.sourceforge.net) 250 | - [PhoneyC](https://github.com/honeynet/phoneyc) - Python honeyclient (later replaced by Thug). 251 | - [Pwnypot](https://github.com/shjalayeri/pwnypot) - High Interaction Client Honeypot. 252 | - [Rumal](https://github.com/thugs-rumal/) - Thug's Rumāl: a Thug's dress and weapon. 253 | - [Shelia](https://www.cs.vu.nl/~herbertb/misc/shelia/) - Client-side honeypot for attack detection. 254 | - [Thug](https://buffer.github.io/thug/) - Python-based low-interaction honeyclient. 255 | - [Thug Distributed Task Queuing](https://thug-distributed.readthedocs.io/en/latest/index.html) 256 | - [Trigona](https://www.honeynet.org/project/Trigona) 257 | - [URLQuery](https://urlquery.net/) 258 | - [YALIH (Yet Another Low Interaction Honeyclient)](https://github.com/Masood-M/yalih) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques. 259 | 260 | - Honeypot 261 | - [Deception Toolkit](http://www.all.net/dtk/dtk.html) 262 | - [IMHoneypot](https://github.com/mushorg/imhoneypot) 263 | 264 | - PDF document inspector 265 | - [peepdf](https://github.com/jesparza/peepdf) - Powerful Python tool to analyze PDF documents. 266 | 267 | - Hybrid low/high interaction honeypot 268 | - [HoneyBrid](http://honeybrid.sourceforge.net) 269 | 270 | - SSH Honeypots 271 | - [Blacknet](https://github.com/morian/blacknet) - Multi-head SSH honeypot system. 272 | - [Cowrie](https://github.com/cowrie/cowrie) - Cowrie SSH Honeypot (based on kippo). 273 | - [DShield docker](https://github.com/xme/dshield-docker) - Docker container running cowrie with DShield output enabled. 274 | - [HonSSH](https://github.com/tnich/honssh) - Logs all SSH communications between a client and server. 275 | - [HUDINX](https://github.com/Cryptix720/HUDINX) - Tiny interaction SSH honeypot engineered in Python to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker. 276 | - [Kippo](https://github.com/desaster/kippo) - Medium interaction SSH honeypot. 277 | - [Kippo_JunOS](https://github.com/gregcmartin/Kippo_JunOS) - Kippo configured to be a backdoored netscreen. 278 | - [Kojoney2](https://github.com/madirish/kojoney2) - Low interaction SSH honeypot written in Python and based on Kojoney by Jose Antonio Coret. 279 | - [Kojoney](http://kojoney.sourceforge.net/) - Python-based Low interaction honeypot that emulates an SSH server implemented with Twisted Conch. 280 | - [LongTail Log Analysis @ Marist College](http://longtail.it.marist.edu/honey/) - Analyzed SSH honeypot logs. 281 | - [Malbait](https://github.com/batchmcnulty/Malbait) - Simple TCP/UDP honeypot implemented in Perl. 282 | - [MockSSH](https://github.com/ncouture/MockSSH) - Mock an SSH server and define all commands it supports (Python, Twisted). 283 | - [cowrie2neo](https://github.com/xlfe/cowrie2neo) - Parse cowrie honeypot logs into a neo4j database. 284 | - [go-sshoney](https://github.com/ashmckenzie/go-sshoney) - SSH Honeypot. 285 | - [go0r](https://github.com/fzerorubigd/go0r) - Simple ssh honeypot in Golang. 286 | - [gohoney](https://github.com/PaulMaddox/gohoney) - SSH honeypot written in Go. 287 | - [hived](https://github.com/sahilm/hived) - Golang-based honeypot. 288 | - [hnypots-agent)](https://github.com/joshrendek/hnypots-agent) - SSH Server in Go that logs username and password combinations. 289 | - [honeypot.go](https://github.com/mdp/honeypot.go) - SSH Honeypot written in Go. 290 | - [honeyssh](https://github.com/ppacher/honeyssh) - Credential dumping SSH honeypot with statistics. 291 | - [hornet](https://github.com/czardoz/hornet) - Medium interaction SSH honeypot that supports multiple virtual hosts. 292 | - [ssh-auth-logger](https://github.com/JustinAzoff/ssh-auth-logger) - Low/zero interaction SSH authentication logging honeypot. 293 | - [ssh-honeypot](https://github.com/droberson/ssh-honeypot) - Fake sshd that logs IP addresses, usernames, and passwords. 294 | - [ssh-honeypot](https://github.com/amv42/sshd-honeypot) - Modified version of the OpenSSH deamon that forwards commands to Cowrie where all commands are interpreted and returned. 295 | - [ssh-honeypotd](https://github.com/sjinks/ssh-honeypotd) - Low-interaction SSH honeypot written in C. 296 | - [sshForShits](https://github.com/traetox/sshForShits) - Framework for a high interaction SSH honeypot. 297 | - [sshesame](https://github.com/jaksi/sshesame) - Fake SSH server that lets everyone in and logs their activity. 298 | - [sshhipot](https://github.com/magisterquis/sshhipot) - High-interaction MitM SSH honeypot. 299 | - [sshlowpot](https://github.com/magisterquis/sshlowpot) - Yet another no-frills low-interaction SSH honeypot in Go. 300 | - [sshsyrup](https://github.com/mkishere/sshsyrup) - Simple SSH Honeypot with features to capture terminal activity and upload to asciinema.org. 301 | - [twisted-honeypots](https://github.com/lanjelot/twisted-honeypots) - SSH, FTP and Telnet honeypots based on Twisted. 302 | 303 | - Distributed sensor project 304 | - [DShield Web Honeypot Project](https://sites.google.com/site/webhoneypotsite/) 305 | 306 | - A pcap analyzer 307 | - [Honeysnap](https://projects.honeynet.org/honeysnap/) 308 | 309 | - Network traffic redirector 310 | - [Honeywall](https://projects.honeynet.org/honeywall/) 311 | 312 | - Honeypot Distribution with mixed content 313 | - [HoneyDrive](https://bruteforcelab.com/honeydrive) 314 | 315 | - Honeypot sensor 316 | - [Honeeepi](https://redmine.honeynet.org/projects/honeeepi/wiki) - Honeypot sensor on a Raspberry Pi based on a customized Raspbian OS. 317 | 318 | - File carving 319 | - [TestDisk & PhotoRec](https://www.cgsecurity.org/) 320 | 321 | - Behavioral analysis tool for win32 322 | - [Capture BAT](https://www.honeynet.org/node/315) 323 | 324 | - Live CD 325 | - [DAVIX](https://www.secviz.org/node/89) - The DAVIX Live CD. 326 | 327 | - Spamtrap 328 | - [Mail::SMTP::Honeypot](https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - Perl module that appears to provide the functionality of a standard SMTP server. 329 | - [Mailoney](https://github.com/awhitehatter/mailoney) - SMTP honeypot, Open Relay, Cred Harvester written in python. 330 | - [SendMeSpamIDS.py](https://github.com/johestephan/VerySimpleHoneypot) - Simple SMTP fetch all IDS and analyzer. 331 | - [Shiva](https://github.com/shiva-spampot/shiva) - Spam Honeypot with Intelligent Virtual Analyzer. 332 | - [Shiva The Spam Honeypot Tips And Tricks For Getting It Up And Running](https://www.pentestpartners.com/security-blog/shiva-the-spam-honeypot-tips-and-tricks-for-getting-it-up-and-running/) 333 | - [SpamHAT](https://github.com/miguelraulb/spamhat) - Spam Honeypot Tool. 334 | - [Spamhole](http://www.spamhole.net/) 335 | - [honeypot](https://github.com/jadb/honeypot) - The Project Honey Pot un-official PHP SDK. 336 | - [spamd](http://man.openbsd.org/cgi-bin/man.cgi?query=spamd%26apropos=0%26sektion=0%26manpath=OpenBSD+Current%26arch=i386%26format=html) 337 | 338 | - Commercial honeynet 339 | - [Cymmetria Mazerunner](ttps://cymmetria.com/products/mazerunner/) - Leads attackers away from real targets and creates a footprint of the attack. 340 | 341 | - Server (Bluetooth) 342 | - [Bluepot](https://github.com/andrewmichaelsmith/bluepot) 343 | 344 | - Dynamic analysis of Android apps 345 | - [Droidbox](https://code.google.com/archive/p/droidbox/) 346 | 347 | - Dockerized Low Interaction packaging 348 | - [Docker honeynet](https://github.com/sreinhardt/Docker-Honeynet) - Several Honeynet tools set up for Docker containers. 349 | - [Dockerized Thug](https://hub.docker.com/r/honeynet/thug/) - Dockerized [Thug](https://github.com/buffer/thug) to analyze malicious web content. 350 | - [Dockerpot](https://github.com/mrschyte/dockerpot) - Docker based honeypot. 351 | - [Manuka](https://github.com/andrewmichaelsmith/manuka) - Docker based honeypot (Dionaea and Kippo). 352 | - [honey_ports](https://github.com/run41/honey_ports) - Very simple but effective docker deployed honeypot to detect port scanning in your environment. 353 | - [mhn-core-docker](https://github.com/MattCarothers/mhn-core-docker) - Core elements of the Modern Honey Network implemented in Docker. 354 | 355 | - Network analysis 356 | - [Quechua](https://bitbucket.org/zaccone/quechua) 357 | 358 | - SIP Server 359 | - [Artemnesia VoIP](http://artemisa.sourceforge.net) 360 | 361 | - IOT Honeypot 362 | - [HoneyThing](https://github.com/omererdem/honeything) - TR-069 Honeypot. 363 | - [Kako](https://github.com/darkarnium/kako) - Honeypots for a number of well known and deployed embedded device vulnerabilities. 364 | 365 | - Honeytokens 366 | - [CanaryTokens](https://github.com/thinkst/canarytokens) - Self-hostable honeytoken generator and reporting dashboard; demo version available at [CanaryTokens.org](https://canarytokens.org/generate). 367 | - [Honeybits](https://github.com/0x4D31/honeybits) - Simple tool designed to enhance the effectiveness of your traps by spreading breadcrumbs and honeytokens across your production servers and workstations to lure the attacker toward your honeypots. 368 | - [Honeyλ (HoneyLambda)](https://github.com/0x4D31/honeylambda) - Simple, serverless application designed to create and monitor URL honeytokens, on top of AWS Lambda and Amazon API Gateway. 369 | - [dcept](https://github.com/secureworks/dcept) - Tool for deploying and detecting use of Active Directory honeytokens. 370 | - [honeyku](https://github.com/0x4D31/honeyku) - Heroku-based web honeypot that can be used to create and monitor fake HTTP endpoints (i.e. honeytokens). 371 | 372 | ## Honeyd Tools 373 | 374 | - Honeyd plugin 375 | - [Honeycomb](http://www.honeyd.org/tools.php) 376 | 377 | - Honeyd viewer 378 | - [Honeyview](http://honeyview.sourceforge.net/) 379 | 380 | - Honeyd to MySQL connector 381 | - [Honeyd2MySQL](https://bruteforcelab.com/honeyd2mysql) 382 | 383 | - A script to visualize statistics from honeyd 384 | - [Honeyd-Viz](https://bruteforcelab.com/honeyd-viz) 385 | 386 | - Honeyd stats 387 | - [Honeydsum.pl](https://github.com/DataSoft/Honeyd/blob/master/scripts/misc/honeydsum-v0.3/honeydsum.pl) 388 | 389 | 390 | 391 | ## Network and Artifact Analysis 392 | 393 | - Sandbox 394 | - [Argos](http://www.few.vu.nl/argos/) - Emulator for capturing zero-day attacks. 395 | - [COMODO automated sandbox](https://help.comodo.com/topic-72-1-451-4768-.html) 396 | - [Cuckoo](https://cuckoosandbox.org/) - Leading open source automated malware analysis system. 397 | - [Pylibemu](https://github.com/buffer/pylibemu) - Libemu Cython wrapper. 398 | - [RFISandbox](https://monkey.org/~jose/software/rfi-sandbox/) - PHP 5.x script sandbox built on top of [funcall](https://pecl.php.net/package/funcall). 399 | - [dorothy2](https://github.com/m4rco-/dorothy2) - Malware/botnet analysis framework written in Ruby. 400 | - [imalse](https://github.com/hbhzwj/imalse) - Integrated MALware Simulator and Emulator. 401 | - [libemu](https://github.com/buffer/libemu) - Shellcode emulation library, useful for shellcode detection. 402 | 403 | 404 | - Sandbox-as-a-Service 405 | - [Hybrid Analysis](https://www.hybrid-analysis.com) - Free malware analysis service powered by Payload Security that detects and analyzes unknown threats using a unique Hybrid Analysis technology. 406 | - [Joebox Cloud](https://jbxcloud.joesecurity.org/login) - Analyzes the behavior of malicious files including PEs, PDFs, DOCs, PPTs, XLSs, APKs, URLs and MachOs on Windows, Android and Mac OS X for suspicious activities. 407 | - [VirusTotal](https://www.virustotal.com/) - Analyze suspicious files and URLs to detect types of malware, and automatically share them with the security community. 408 | - [malwr.com](https://malwr.com/) - Free malware analysis service and community. 409 | 410 | ## Data Tools 411 | 412 | - Front Ends 413 | - [DionaeaFR](https://github.com/rubenespadas/DionaeaFR) - Front Web to Dionaea low-interaction honeypot. 414 | - [Django-kippo](https://github.com/jedie/django-kippo) - Django App for kippo SSH Honeypot. 415 | - [Shockpot-Frontend](https://github.com/GovCERT-CZ/Shockpot-Frontend) - Full featured script to visualize statistics from a Shockpot honeypot. 416 | - [Tango](https://github.com/aplura/Tango) - Honeypot Intelligence with Splunk. 417 | - [Wordpot-Frontend](https://github.com/GovCERT-CZ/Wordpot-Frontend) - Full featured script to visualize statistics from a Wordpot honeypot. 418 | - [honeyalarmg2](https://github.com/schmalle/honeyalarmg2) - Simplified UI for showing honeypot alarms. 419 | - [honeypotDisplay](https://github.com/Joss-Steward/honeypotDisplay) - Flask website which displays data gathered from an SSH Honeypot. 420 | 421 | - Visualization 422 | - [Acapulco](https://github.com/hgascon/acapulco) - Automated Attack Community Graph Construction. 423 | - [Afterglow Cloud](https://github.com/ayrus/afterglow-cloud) 424 | - [Afterglow](http://afterglow.sourceforge.net/) 425 | - [Glastopf Analytics](https://github.com/katkad/Glastopf-Analytics) - Easy honeypot statistics. 426 | - [HoneyMalt](https://github.com/SneakersInc/HoneyMalt) - Maltego tranforms for mapping Honeypot systems. 427 | - [HoneyMap](https://github.com/fw42/honeymap) - Real-time websocket stream of GPS events on a fancy SVG world map. 428 | - [HoneyStats](https://sourceforge.net/projects/honeystats/) - Statistical view of the recorded activity on a Honeynet. 429 | - [HpfeedsHoneyGraph](https://github.com/yuchincheng/HpfeedsHoneyGraph) - Visualization app to visualize hpfeeds logs. 430 | - [Kippo stats](https://github.com/mfontani/kippo-stats) - Mojolicious app to display statistics for your kippo SSH honeypot. 431 | - [Kippo-Graph](https://bruteforcelab.com/kippo-graph) - Full featured script to visualize statistics from a Kippo SSH honeypot. 432 | - [The Intelligent HoneyNet](https://github.com/jpyorre/IntelligentHoneyNet) - Create actionable information from honeypots. 433 | - [ovizart](https://github.com/oguzy/ovizart) - Visual analysis for network traffic. 434 | 435 | ## Guides 436 | 437 | - [T-Pot: A Multi-Honeypot Platform](https://dtag-dev-sec.github.io/mediator/feature/2015/03/17/concept.html) 438 | - [Honeypot (Dionaea and kippo) setup script](https://github.com/andrewmichaelsmith/honeypot-setup-script/) 439 | 440 | - Deployment 441 | - [Dionaea and EC2 in 20 Minutes](http://andrewmichaelsmith.com/2012/03/dionaea-honeypot-on-ec2-in-20-minutes/) - Tutorial on setting up Dionaea on an EC2 instance. 442 | - [Using a Raspberry Pi honeypot to contribute data to DShield/ISC](https://isc.sans.edu/diary/22680) - The Raspberry Pi based system will allow us to maintain one code base that will make it easier to collect rich logs beyond firewall logs. 443 | - [honeypotpi](https://github.com/free5ty1e/honeypotpi) - Script for turning a Raspberry Pi into a HoneyPot Pi. 444 | 445 | - Research Papers 446 | - [Honeypot research papers](https://github.com/shbhmsingh72/Honeypot-Research-Papers) - PDFs of research papers on honeypots. 447 | - [vEYE](https://link.springer.com/article/10.1007%2Fs10115-008-0137-3) - Behavioral footprinting for self-propagating worm detection and profiling. 448 | --------------------------------------------------------------------------------