h0neytr4p – configurable web honeypot for reconnaissance and exploits

h0neytr4p is a web-focused honeypot intended to make it easier for blue teams to detect reconnaissance and exploitation attempts. Instead of constructing and maintaining an intentionally vulnerable web application, defenders create individual traps corresponding to vulnerabilities, exploits or reconnaissance techniques they want to detect.

Trap definitions are stored separately, making the system particularly useful when defenders want to react quickly to a new advisory or a newly observed attack technique. A suitable trap can be added without reproducing the complete vulnerable product. The same approach can be used to identify automated external reconnaissance from scanners probing exposed infrastructure for known paths and weaknesses.

This is free and open source software.

Key Features

• Trap-based architecture for representing individual vulnerabilities, exploits and reconnaissance techniques.
• Loads trap definitions from a dedicated traps directory.
• Can listen for traps across multiple ports.
• Designed for identifying web exploitation and reconnaissance traffic.
• Useful for rapidly deploying detection logic for newly disclosed web vulnerabilities.
• Can reveal automated scanning of an organisation’s external attack surface.
• Writes captured activity to a consolidated JSON log.
• Logs additional request information including cookies, HTTP headers and destination ports.
• Payload handler can save submitted attack payloads for subsequent examination.
• Configurable payload-size limits help control stored data.
• Supports separately defined limits for multipart and other payloads.
• Optional catch-all payload collection.
• Docker support provides a straightforward isolated deployment route.
• The modular trap approach avoids needing a complete deliberately vulnerable application for each detection scenario.

Website: github.com/pbssubhash/h0neytr4p
Support:
Developer: pbssubhash
License: Apache License 2.0

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.