h0neytr4p is a web-focused honeypot intended to make it easier for blue teams to detect reconnaissance and exploitation attempts. Instead of constructing and maintaining an intentionally vulnerable web application, defenders create individual traps corresponding to vulnerabilities, exploits or reconnaissance techniques they want to detect.
Trap definitions are stored separately, making the system particularly useful when defenders want to react quickly to a new advisory or a newly observed attack technique. A suitable trap can be added without reproducing the complete vulnerable product. The same approach can be used to identify automated external reconnaissance from scanners probing exposed infrastructure for known paths and weaknesses.
This is free and open source software.
Key Features
- Trap-based architecture for representing individual vulnerabilities, exploits and reconnaissance techniques.
- Loads trap definitions from a dedicated traps directory.
- Can listen for traps across multiple ports.
- Designed for identifying web exploitation and reconnaissance traffic.
- Useful for rapidly deploying detection logic for newly disclosed web vulnerabilities.
- Can reveal automated scanning of an organisation’s external attack surface.
- Writes captured activity to a consolidated JSON log.
- Logs additional request information including cookies, HTTP headers and destination ports.
- Payload handler can save submitted attack payloads for subsequent examination.
- Configurable payload-size limits help control stored data.
- Supports separately defined limits for multipart and other payloads.
- Optional catch-all payload collection.
- Docker support provides a straightforward isolated deployment route.
- The modular trap approach avoids needing a complete deliberately vulnerable application for each detection scenario.
Website: github.com/pbssubhash/h0neytr4p
Support:
Developer: pbssubhash
License: Apache License 2.0
Related Software
| Honeypot Tools | |
|---|---|
| OpenCanary | Multi-protocol network decoy for detecting attacks |
| Dionaea | Traps exploits and captures malware samples |
| SentryPeer | Spots malicious SIP traffic and attempts to abuse VoIP systems |
| Heralding | Records usernames and passwords submitted by attackers |
| h0neytr4p | Web-focused trap for inspecting hostile HTTP requests and probing |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.