Heralding – credentials-catching network honeypot

Heralding takes a deliberately focused approach to honeypots. Its main job is to collect credentials submitted by attackers rather than reproduce complete vulnerable systems. It presents a collection of familiar authentication services, waits for connection and login attempts, and records the resulting session information for later analysis.

That narrow scope makes Heralding useful when the primary interest is discovering the usernames and passwords being tried by bots, scanners and human attackers. The collected information can help reveal common credential dictionaries, targeted usernames and changes in brute-force behaviour. Session-level data provides additional context so authentication attempts need not be examined as isolated events.

This is free and open source software.

Key Features

• Supports FTP and Telnet authentication traps.
• SSH credential collection.
• HTTP and HTTPS listeners.
• POP3 and encrypted POP3S support.
• IMAP and IMAPS services.
• SMTP credential collection.
• VNC authentication support.
• PostgreSQL and SOCKS5 listeners.
• Writes complete session information in JSON Lines format.
• Session records include timestamps, duration, source and destination information, protocol and authentication-attempt counts.
• Stores connection and session summaries in CSV format.
• Maintains a separate authentication log containing captured usernames and plaintext passwords where the protocol permits their collection.
• Records protocol-specific auxiliary information, such as details exposed during SSH sessions.
• Authentication attempts can be logged immediately rather than waiting for the corresponding session to terminate.
• Can be built and deployed as a Docker container.

Website: github.com/johnnykv/heralding
Support:
Developer: Johnny Vestergaard
License: GNU General Public License v3.0

Heralding is written in Python. Learn Python with our recommended free books and free tutorials.

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.