[38;5;12m                           [39m[38;2;255;187;0m[1m[4mAwesome Honeypots [0m[38;5;14m[1m[4m![0m[38;2;255;187;0m[1m[4mAwesome Honeypots[0m[38;5;14m[1m[4m (https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)[0m[38;2;255;187;0m[1m[4m (https://github.com/sindresorhus/awesome)[0m

[38;5;12mA curated list of awesome honeypots, plus related components and much more, divided into categories such as Web, services, and others, with a focus on free and open source projects.[39m

[38;5;12mThere is no pre-established order of items in each category, the order is for contribution. If you want to contribute, please read the [39m[38;5;14m[1mguide[0m[38;5;12m (CONTRIBUTING.md).[39m

[38;5;12mDiscover more awesome lists at [39m[38;5;14m[1msindresorhus/awesome[0m[38;5;12m (https://github.com/sindresorhus/awesome).[39m

[38;5;12m                                                                                                                  [39m[38;2;255;187;0m[1m[4mContents[0m

[38;5;12m- [39m[38;5;14m[1mAwesome Honeypots ![0m[38;5;12mAwesome Honeypots[39m[38;5;14m[1m (https://github.com/sindresorhus/awesome)[0m[38;5;12m (#awesome-honeypots-)[39m
[38;5;12m- [39m[38;5;14m[1mContents[0m[38;5;12m (#contents)[39m
[38;5;12m  - [39m[38;5;14m[1mRelated Lists[0m[38;5;12m (#related-lists)[39m
[38;5;12m  - [39m[38;5;14m[1mHoneypots[0m[38;5;12m (#honeypots)[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyd Tools[0m[38;5;12m (#honeyd-tools)[39m
[38;5;12m  - [39m[38;5;14m[1mNetwork and Artifact Analysis[0m[38;5;12m (#network-and-artifact-analysis)[39m
[38;5;12m  - [39m[38;5;14m[1mData Tools[0m[38;5;12m (#data-tools)[39m
[38;5;12m  - [39m[38;5;14m[1mGuides[0m[38;5;12m (#guides)[39m

[38;2;255;187;0m[4mRelated Lists[0m

[38;5;12m- [39m[38;5;14m[1mawesome-pcaptools[0m[38;5;12m (https://github.com/caesar0301/awesome-pcaptools) - Useful in network traffic analysis.[39m
[38;5;12m- [39m[38;5;14m[1mawesome-malware-analysis[0m[38;5;12m (https://github.com/rshipp/awesome-malware-analysis) - Some overlap here for artifact analysis.[39m

[38;2;255;187;0m[4mHoneypots[0m

[38;5;12m- Database Honeypots[39m

[38;5;12m  - [39m[38;5;14m[1mDelilah[0m[38;5;12m (https://github.com/SecurityTW/delilah) - Elasticsearch Honeypot written in Python (originally from Novetta).[39m
[38;5;12m  - [39m[38;5;14m[1mESPot[0m[38;5;12m (https://github.com/mycert/ESPot) - Elasticsearch honeypot written in NodeJS, to capture every attempts to exploit CVE-2014-3120.[39m
[38;5;12m  - [39m[38;5;14m[1mElasticPot[0m[38;5;12m (https://gitlab.com/bontchev/elasticpot) - An Elasticsearch Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mElastic honey[0m[38;5;12m (https://github.com/jordan-wright/elastichoney) - Simple Elasticsearch Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mMongoDB-HoneyProxy[0m[38;5;12m (https://github.com/Plazmaz/MongoDB-HoneyProxy) - MongoDB honeypot proxy.[39m
[38;5;12m  - [39m[38;5;14m[1mNoSQLpot[0m[38;5;12m (https://github.com/torque59/nosqlpot) - Honeypot framework built on a NoSQL-style database.[39m
[38;5;12m  - [39m[38;5;14m[1mmysql-honeypotd[0m[38;5;12m (https://github.com/sjinks/mysql-honeypotd) - Low interaction MySQL honeypot written in C.[39m
[38;5;12m  - [39m[38;5;14m[1mMysqlPot[0m[38;5;12m (https://github.com/schmalle/MysqlPot) - MySQL honeypot, still very early stage.[39m
[38;5;12m  - [39m[38;5;14m[1mpghoney[0m[38;5;12m (https://github.com/betheroot/pghoney) - Low-interaction Postgres Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1msticky_elephant[0m[38;5;12m (https://github.com/betheroot/sticky_elephant) - Medium interaction postgresql honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mRedisHoneyPot[0m[38;5;12m (https://github.com/cypwnpwnsocute/RedisHoneyPot) - High Interaction Honeypot Solution for Redis protocol.[39m

[38;5;12m- Web honeypots[39m

[38;5;12m  - [39m[38;5;14m[1mExpress honeypot[0m[38;5;12m (https://github.com/christophe77/express-honeypot) - RFI & LFI honeypot using nodeJS and express.[39m
[38;5;12m  - [39m[38;5;14m[1mEoHoneypotBundle[0m[38;5;12m (https://github.com/eymengunay/EoHoneypotBundle) - Honeypot type for Symfony2 forms.[39m
[38;5;12m  - [39m[38;5;14m[1mGlastopf[0m[38;5;12m (https://github.com/mushorg/glastopf) - Web Application Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mGoogle Hack Honeypot[0m[38;5;12m (http://ghh.sourceforge.net) - Designed to provide reconnaissance against attackers that use search engines as a hacking tool against your resources.[39m
[38;5;12m  - [39m[38;5;14m[1mHellPot[0m[38;5;12m (https://github.com/yunginnanet/HellPot) - Honeypot that tries to crash the bots and clients that visit it's location.[39m
[38;5;12m  - [39m[38;5;14m[1mLaravel Application Honeypot[0m[38;5;12m (https://github.com/msurguy/Honeypot) - Simple spam prevention package for Laravel applications.[39m
[38;5;12m  - [39m[38;5;14m[1mNodepot[0m[38;5;12m (https://github.com/schmalle/Nodepot) - NodeJS web application honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mPasitheaHoneypot[0m[38;5;12m (https://github.com/Marist-Innovation-Lab/PasitheaHoneypot) - RestAPI honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mServletpot[0m[38;5;12m (https://github.com/schmalle/servletpot) - Web application Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mShadow Daemon[0m[38;5;12m (https://shadowd.zecure.org/overview/introduction/) - Modular Web Application Firewall / High-Interaction Honeypot for PHP, Perl, and Python apps.[39m
[38;5;12m  - [39m[38;5;14m[1mStrutsHoneypot[0m[38;5;12m (https://github.com/Cymmetria/StrutsHoneypot) - Struts Apache 2 based honeypot as well as a detection module for Apache 2 servers.[39m
[38;5;12m  - [39m[38;5;14m[1mWebTrap[0m[38;5;12m (https://github.com/IllusiveNetworks-Labs/WebTrap) - Designed to create deceptive webpages to deceive and redirect attackers away from real websites.[39m
[38;5;12m  - [39m[38;5;14m[1mbasic-auth-pot (bap)[0m[38;5;12m (https://github.com/bjeborn/basic-auth-pot) - HTTP Basic Authentication honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mbwpot[0m[38;5;12m (https://github.com/graneed/bwpot) - Breakable Web applications honeyPot.[39m
[38;5;12m  - [39m[38;5;14m[1mdjango-admin-honeypot[0m[38;5;12m (https://github.com/dmpayton/django-admin-honeypot) - Fake Django admin login screen to notify admins of attempted unauthorized access.[39m
[38;5;12m  - [39m[38;5;14m[1mdrupo[0m[38;5;12m (https://github.com/d1str0/drupot) - Drupal Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mgalah[0m[38;5;12m (https://github.com/0x4D31/galah) - an LLM-powered web honeypot using the OpenAI API.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneyhttpd[0m[38;5;12m (https://github.com/bocajspear1/honeyhttpd) - Python-based web server honeypot builder.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneyup[0m[38;5;12m (https://github.com/LogoiLab/honeyup) - An uploader honeypot designed to look like poor website security.[39m
[38;5;12m  - [39m[38;5;14m[1mmodpot[0m[38;5;12m (https://github.com/referefref/modpot) - Modpot is a modular web application honeypot framework and management application written in Golang and making use of gin framework.[39m
[38;5;12m  - [39m[38;5;14m[1mowa-honeypot[0m[38;5;12m (https://github.com/joda32/owa-honeypot) - A basic flask based Outlook Web Honey pot.[39m
[38;5;12m  - [39m[38;5;14m[1mphpmyadmin_honeypot[0m[38;5;12m (https://github.com/gfoss/phpmyadmin_honeypot) - Simple and effective phpMyAdmin honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mshockpot[0m[38;5;12m (https://github.com/threatstream/shockpot) - WebApp Honeypot for detecting Shell Shock exploit attempts.[39m
[38;5;12m  - [39m[38;5;14m[1msmart-honeypot[0m[38;5;12m (https://github.com/freak3dot/smart-honeypot) - PHP Script demonstrating a smart honey pot.[39m
[38;5;12m  - Snare/Tanner - successors to Glastopf[39m
[48;5;235m[38;5;249m- **Snare** (https://github.com/mushorg/snare) - Super Next generation Advanced Reactive honeypot.[49m[39m
[48;5;235m[38;5;249m- **Tanner** (https://github.com/mushorg/tanner) - Evaluating SNARE events.[49m[39m[48;5;235m[38;5;249m                       [49m[39m
[38;5;12m  - [39m[38;5;14m[1mstack-honeypot[0m[38;5;12m (https://github.com/CHH/stack-honeypot) - Inserts a trap for spam bots into responses.[39m
[38;5;12m  - [39m[38;5;14m[1mtomcat-manager-honeypot[0m[38;5;12m (https://github.com/helospark/tomcat-manager-honeypot) - Honeypot that mimics Tomcat manager endpoints. Logs requests and saves attacker's WAR file for later study.[39m
[38;5;12m  - WordPress honeypots[39m
[48;5;235m[38;5;249m- **HonnyPotter** (https://github.com/MartinIngesen/HonnyPotter) - WordPress login honeypot for collection and analysis of failed login attempts.[49m[39m
[48;5;235m[38;5;249m- **HoneyPress** (https://github.com/kungfuguapo/HoneyPress) - Python based WordPress honeypot in a Docker container.[49m[39m[48;5;235m[38;5;249m                            [49m[39m
[48;5;235m[38;5;249m- **wp-smart-honeypot** (https://github.com/freak3dot/wp-smart-honeypot) - WordPress plugin to reduce comment spam with a smarter honeypot.[49m[39m[48;5;235m[38;5;249m      [49m[39m
[48;5;235m[38;5;249m- **wordpot** (https://github.com/gbrindisi/wordpot) - WordPress Honeypot.[49m[39m[48;5;235m[38;5;249m                                                                       [49m[39m
[38;5;12m  - [39m[38;5;14m[1mPython-Honeypot[0m[38;5;12m (https://github.com/OWASP/Python-Honeypot) - OWASP Honeypot, Automated Deception Framework.[39m

[38;5;12m- Service Honeypots[39m
[38;5;12m  - [39m[38;5;14m[1mADBHoney[0m[38;5;12m (https://github.com/huuck/ADBHoney) - Low interaction honeypot that simulates an Android device running Android Debug Bridge (ADB) server process.[39m
[38;5;12m  - [39m[38;5;14m[1mAMTHoneypot[0m[38;5;12m (https://github.com/packetflare/amthoneypot) - Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689.[39m
[38;5;12m  - [39m[38;5;14m[1mddospot[0m[38;5;12m (https://github.com/aelth/ddospot) - NTP, DNS, SSDP, Chargen and generic UDP-based amplification DDoS honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mdionaea[0m[38;5;12m (https://github.com/DinoTools/dionaea) - Home of the dionaea honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mdhp[0m[38;5;12m (https://github.com/ciscocsirt/dhp) - Simple Docker Honeypot server emulating small snippets of the Docker HTTP API.[39m
[38;5;12m  - [39m[38;5;14m[1mDolosHoneypot[0m[38;5;12m (https://github.com/Marist-Innovation-Lab/DolosHoneypot) - SDN (software defined networking) honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mEnsnare[0m[38;5;12m (https://github.com/ahoernecke/ensnare) - Easy to deploy Ruby honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mHelix[0m[38;5;12m (https://github.com/Zeerg/helix-honeypot) - K8s API Honeypot with Active Defense Capabilities.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneycomb_plugins[0m[38;5;12m (https://github.com/Cymmetria/honeycomb_plugins) - Plugin repository for Honeycomb, the honeypot framework by Cymmetria.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneydb[0m[38;5;12m  (https://honeydb.io/downloads) - Multi-service honeypot that is easy to deploy and configure. Can be configured to send interaction data to to HoneyDB's centralized collectors for access via REST API.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneyntp[0m[38;5;12m (https://github.com/fygrave/honeyntp) - NTP logger/honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneypot-camera[0m[38;5;12m (https://github.com/alexbredo/honeypot-camera) - Observation camera honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneypot-ftp[0m[38;5;12m (https://github.com/alexbredo/honeypot-ftp) - FTP Honeypot.[39m
[38;5;12m  [39m[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mhoneypots[0m[38;5;12m [39m[38;5;12m(https://github.com/qeeqbox/honeypots)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12m25[39m[38;5;12m [39m[38;5;12mdifferent[39m[38;5;12m [39m[38;5;12mhoneypots[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12msingle[39m[38;5;12m [39m[38;5;12mpypi[39m[38;5;12m [39m[38;5;12mpackage![39m[38;5;12m [39m[38;5;12m(dns,[39m[38;5;12m [39m[38;5;12mftp,[39m[38;5;12m [39m[38;5;12mhttpproxy,[39m[38;5;12m [39m[38;5;12mhttp,[39m[38;5;12m [39m[38;5;12mhttps,[39m[38;5;12m [39m[38;5;12mimap,[39m[38;5;12m [39m[38;5;12mmysql,[39m[38;5;12m [39m[38;5;12mpop3,[39m[38;5;12m [39m[38;5;12mpostgres,[39m[38;5;12m [39m[38;5;12mredis,[39m[38;5;12m [39m[38;5;12msmb,[39m[38;5;12m [39m[38;5;12msmtp,[39m[38;5;12m [39m[38;5;12msocks5,[39m[38;5;12m [39m[38;5;12mssh,[39m[38;5;12m [39m[38;5;12mtelnet,[39m[38;5;12m [39m[38;5;12mvnc,[39m[38;5;12m [39m[38;5;12mmssql,[39m[38;5;12m [39m[38;5;12melastic,[39m[38;5;12m [39m[38;5;12mldap,[39m[38;5;12m [39m
[38;5;12mntp,[39m[38;5;12m [39m[38;5;12mmemcache,[39m[38;5;12m [39m[38;5;12msnmp,[39m[38;5;12m [39m[38;5;12moracle,[39m[38;5;12m [39m[38;5;12msip[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mirc).[39m
[38;5;12m  - [39m[38;5;14m[1mhoneytrap[0m[38;5;12m (https://github.com/honeytrap/honeytrap) - Advanced Honeypot framework written in Go that can be connected with other honeypot software.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyPy[0m[38;5;12m (https://github.com/foospidy/HoneyPy) - Low interaction honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneygrove[0m[38;5;12m (https://github.com/UHH-ISS/honeygrove) - Multi-purpose modular honeypot based on Twisted.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyport[0m[38;5;12m (https://github.com/securitygeneration/Honeyport) - Simple honeyport written in Bash and Python.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyprint[0m[38;5;12m (https://github.com/glaslos/honeyprint) - Printer honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mLyrebird[0m[38;5;12m (https://hub.docker.com/r/lyrebird/honeypot-base/) - Modern high-interaction honeypot framework.[39m
[38;5;12m  - [39m[38;5;14m[1mMICROS honeypot[0m[38;5;12m (https://github.com/Cymmetria/micros_honeypot) - Low interaction honeypot to detect CVE-2018-2636 in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (MICROS).[39m
[38;5;12m  - [39m[38;5;14m[1mnode-ftp-honeypot[0m[38;5;12m (https://github.com/christophe77/node-ftp-honeypot) - FTP server honeypot in JS.[39m
[38;5;12m  - [39m[38;5;14m[1mpyrdp[0m[38;5;12m (https://github.com/gosecure/pyrdp) - RDP man-in-the-middle and library for Python 3 with the ability to watch connections live or after the fact.[39m
[38;5;12m  - [39m[38;5;14m[1mrdppot[0m[38;5;12m (https://github.com/kryptoslogic/rdppot) - RDP honeypot[39m
[38;5;12m  - [39m[38;5;14m[1mRDPy[0m[38;5;12m (https://github.com/citronneur/rdpy) - Microsoft Remote Desktop Protocol (RDP) honeypot implemented in Python.[39m
[38;5;12m  - [39m[38;5;14m[1mSMB Honeypot[0m[38;5;12m (https://github.com/r0hi7/HoneySMB) - High interaction SMB service honeypot capable of capturing wannacry-like Malware.[39m
[38;5;12m  - [39m[38;5;14m[1mTom's Honeypot[0m[38;5;12m (https://github.com/inguardians/toms_honeypot) - Low interaction Python honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mtroje[0m[38;5;12m (https://github.com/dutchcoders/troje/) - Honeypot that runs each connection with the service within a separate LXC container.[39m
[38;5;12m  - [39m[38;5;14m[1mWebLogic honeypot[0m[38;5;12m (https://github.com/Cymmetria/weblogic_honeypot) - Low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware.[39m
[38;5;12m  - [39m[38;5;14m[1mWhiteFace Honeypot[0m[38;5;12m (https://github.com/csirtgadgets/csirtg-honeypot) - Twisted based honeypot for WhiteFace.[39m
[38;5;12m [39m
[38;5;12m- Distributed Honeypots[39m

[38;5;12m  - [39m[38;5;14m[1mDemonHunter[0m[38;5;12m (https://github.com/RevengeComing/DemonHunter) - Low interaction honeypot server.[39m

[38;5;12m- Anti-honeypot stuff[39m

[38;5;12m  - [39m[38;5;14m[1mcanarytokendetector[0m[38;5;12m (https://github.com/referefref/canarytokendetector) - Tool for detection and nullification of Thinkst CanaryTokens[39m
[38;5;12m  - [39m[38;5;14m[1mhoneydet[0m[38;5;12m (https://github.com/referefref/honeydet) - Signature based honeypot detector tool written in Golang[39m
[38;5;12m  - [39m[38;5;14m[1mkippo_detect[0m[38;5;12m (https://github.com/andrew-morris/kippo_detect) - Offensive component that detects the presence of the kippo honeypot.[39m

[38;5;12m- ICS/SCADA honeypots[39m

[38;5;12m  - [39m[38;5;14m[1mConpot[0m[38;5;12m (https://github.com/mushorg/conpot) - ICS/SCADA honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mGasPot[0m[38;5;12m (https://github.com/sjhilt/GasPot) - Veeder Root Gaurdian AST, common in the oil and gas industry.[39m
[38;5;12m  - [39m[38;5;14m[1mSCADA honeynet[0m[38;5;12m (http://scadahoneynet.sourceforge.net) - Building Honeypots for Industrial Networks.[39m
[38;5;12m  - [39m[38;5;14m[1mgridpot[0m[38;5;12m (https://github.com/sk4ld/gridpot) - Open source tools for realistic-behaving electric grid honeynets.[39m
[38;5;12m  [39m[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mscada-honeynet[0m[38;5;12m [39m[38;5;12m(http://www.digitalbond.com/blog/2007/07/24/scada-honeynet-article-in-infragard-publication/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mMimics[39m[38;5;12m [39m[38;5;12mmany[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mservices[39m[38;5;12m [39m[38;5;12mfrom[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mpopular[39m[38;5;12m [39m[38;5;12mPLC[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mbetter[39m[38;5;12m [39m[38;5;12mhelps[39m[38;5;12m [39m[38;5;12mSCADA[39m[38;5;12m [39m[38;5;12mresearchers[39m[38;5;12m [39m[38;5;12munderstand[39m[38;5;12m [39m[38;5;12mpotential[39m[38;5;12m [39m[38;5;12mrisks[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mexposed[39m[38;5;12m [39m
[38;5;12mcontrol[39m[38;5;12m [39m[38;5;12msystem[39m[38;5;12m [39m[38;5;12mdevices.[39m

[38;5;12m- Other/random[39m

[38;5;12m  - [39m[38;5;14m[1mCitrixHoneypot[0m[38;5;12m (https://github.com/MalwareTech/CitrixHoneypot) - Detect and log CVE-2019-19781 scan and exploitation attempts.[39m
[38;5;12m  - [39m[38;5;14m[1mDamn Simple Honeypot (DSHP)[0m[38;5;12m (https://github.com/naorlivne/dshp) - Honeypot framework with pluggable handlers.[39m
[38;5;12m  - [39m[38;5;14m[1mdicompot[0m[38;5;12m (https://github.com/nsmfoo/dicompot) - DICOM Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mIPP Honey[0m[38;5;12m (https://gitlab.com/bontchev/ipphoney) - A honeypot for the Internet Printing Protocol.[39m
[38;5;12m  - [39m[38;5;14m[1mLog4Pot[0m[38;5;12m (https://github.com/thomaspatzke/Log4Pot) - A honeypot for the Log4Shell vulnerability (CVE-2021-44228).[39m
[38;5;12m  - [39m[38;5;14m[1mMasscanned[0m[38;5;12m (https://github.com/ivre/masscanned) - Let's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise.[39m
[38;5;12m  - [39m[38;5;14m[1mmedpot[0m[38;5;12m (https://github.com/schmalle/medpot) -  HL7 / FHIR honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mNOVA[0m[38;5;12m (https://github.com/DataSoft/Nova) - Uses honeypots as detectors, looks like a complete system.[39m
[38;5;12m  - [39m[38;5;14m[1mOpenFlow Honeypot (OFPot)[0m[38;5;12m (https://github.com/upa/ofpot) - Redirects traffic for unused IPs to a honeypot, built on POX.[39m
[38;5;12m  - [39m[38;5;14m[1mOpenCanary[0m[38;5;12m (https://github.com/thinkst/opencanary) - Modular and decentralised honeypot daemon that runs several canary versions of services that alerts when a service is (ab)used.[39m
[38;5;12m  - [39m[38;5;14m[1mciscoasa_honeypot[0m[38;5;12m (https://github.com/cymmetria/ciscoasa_honeypot) A low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability.[39m
[38;5;12m  - [39m[38;5;14m[1mminiprint[0m[38;5;12m (https://github.com/sa7mon/miniprint) - A medium interaction printer honeypot.[39m

[38;5;12m- Botnet C2 tools[39m

[38;5;12m  - [39m[38;5;14m[1mHale[0m[38;5;12m (https://github.com/pjlantz/Hale) - Botnet command and control monitor.[39m
[38;5;12m  - [39m[38;5;14m[1mdnsMole[0m[38;5;12m (https://code.google.com/archive/p/dns-mole/) - Analyses DNS traffic and potentionaly detect botnet command and control server activity, along with infected hosts.[39m

[38;5;12m- IPv6 attack detection tool[39m

[38;5;12m  - [39m[38;5;14m[1mipv6-attack-detector[0m[38;5;12m (https://github.com/mzweilin/ipv6-attack-detector/) - Google Summer of Code 2012 project, supported by The Honeynet Project organization.[39m

[38;5;12m- Dynamic code instrumentation toolkit[39m

[38;5;12m  - [39m[38;5;14m[1mFrida[0m[38;5;12m (https://www.frida.re) - Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android.[39m

[38;5;12m- Tool to convert website to server honeypots[39m

[38;5;12m  - [39m[38;5;14m[1mHIHAT[0m[38;5;12m (http://hihat.sourceforge.net/) - Transform arbitrary PHP applications into web-based high-interaction Honeypots.[39m

[38;5;12m- Malware collector[39m

[38;5;12m  - [39m[38;5;14m[1mKippo-Malware[0m[38;5;12m (https://bruteforcelab.com/kippo-malware) - Python script that will download all malicious files stored as URLs in a Kippo SSH honeypot database.[39m

[38;5;12m- Distributed sensor deployment[39m

[38;5;12m  [39m[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mCommunity[0m[38;5;14m[1m [0m[38;5;14m[1mHoney[0m[38;5;14m[1m [0m[38;5;14m[1mNetwork[0m[38;5;12m [39m[38;5;12m(https://communityhoneynetwork.readthedocs.io/en/stable/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mCHN[39m[38;5;12m [39m[38;5;12maims[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mmake[39m[38;5;12m [39m[38;5;12mdeployments[39m[38;5;12m [39m[38;5;12mhoneypots[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mhoneypot[39m[38;5;12m [39m[38;5;12mmanagement[39m[38;5;12m [39m[38;5;12mtools[39m[38;5;12m [39m[38;5;12measy[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mflexible.[39m[38;5;12m [39m[38;5;12mThe[39m[38;5;12m [39m[38;5;12mdefault[39m[38;5;12m [39m[38;5;12mdeployment[39m[38;5;12m [39m[38;5;12mmethod[39m[38;5;12m [39m[38;5;12muses[39m[38;5;12m [39m[38;5;12mDocker[39m[38;5;12m [39m[38;5;12mCompose[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mDocker[39m
[38;5;12mto[39m[38;5;12m [39m[38;5;12mdeploy[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mfew[39m[38;5;12m [39m[38;5;12msimple[39m[38;5;12m [39m[38;5;12mcommands.[39m
[38;5;12m  - [39m[38;5;14m[1mModern Honey Network[0m[38;5;12m (https://github.com/threatstream/mhn) - Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management.[39m

[38;5;12m- Network Analysis Tool[39m

[38;5;12m  - [39m[38;5;14m[1mTracexploit[0m[38;5;12m (https://code.google.com/archive/p/tracexploit/) - Replay network packets.[39m

[38;5;12m- Log anonymizer[39m

[38;5;12m  - [39m[38;5;14m[1mLogAnon[0m[38;5;12m (http://code.google.com/archive/p/loganon/) - Log anonymization library that helps having anonymous logs consistent between logs and network captures.[39m

[38;5;12m- Low interaction honeypot (router back door)[39m

[38;5;12m  - [39m[38;5;14m[1mHoneypot-32764[0m[38;5;12m (https://github.com/knalli/honeypot-for-tcp-32764) - Honeypot for router backdoor (TCP 32764).[39m
[38;5;12m  - [39m[38;5;14m[1mWAPot[0m[38;5;12m (https://github.com/lcashdol/WAPot) - Honeypot that can be used to observe traffic directed at home routers.[39m

[38;5;12m- honeynet farm traffic redirector[39m

[38;5;12m  - [39m[38;5;14m[1mHoneymole[0m[38;5;12m (https://web.archive.org/web/20100326040550/http://www.honeynet.org.pt:80/index.php/HoneyMole) - Deploy multiple sensors that redirect traffic to a centralized collection of honeypots.[39m

[38;5;12m- HTTPS Proxy[39m

[38;5;12m  - [39m[38;5;14m[1mmitmproxy[0m[38;5;12m (https://mitmproxy.org/) - Allows traffic flows to be intercepted, inspected, modified, and replayed.[39m

[38;5;12m- System instrumentation[39m

[38;5;12m  - [39m[38;5;14m[1mSysdig[0m[38;5;12m (https://sysdig.com/opensource/) - Open source, system-level exploration allows one to capture system state and activity from a running GNU/Linux instance, then save, filter, and analyze the results.[39m
[38;5;12m  - [39m[38;5;14m[1mFibratus[0m[38;5;12m (https://github.com/rabbitstack/fibratus) - Tool for exploration and tracing of the Windows kernel.[39m

[38;5;12m- Honeypot for USB-spreading malware[39m

[38;5;12m  - [39m[38;5;14m[1mGhost-usb[0m[38;5;12m (https://github.com/honeynet/ghost-usb-honeypot) - Honeypot for malware that propagates via USB storage devices.[39m

[38;5;12m- Data Collection[39m

[38;5;12m  - [39m[38;5;14m[1mKippo2MySQL[0m[38;5;12m (https://bruteforcelab.com/kippo2mysql) - Extracts some very basic stats from Kippo’s text-based log files and inserts them in a MySQL database.[39m
[38;5;12m  - [39m[38;5;14m[1mKippo2ElasticSearch[0m[38;5;12m (https://bruteforcelab.com/kippo2elasticsearch) - Python script to transfer data from a Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster).[39m

[38;5;12m- Passive network audit framework parser[39m

[38;5;12m  - [39m[38;5;14m[1mPassive Network Audit Framework (pnaf)[0m[38;5;12m (https://github.com/jusafing/pnaf) - Framework that combines multiple passive and automated analysis techniques in order to provide a security assessment of network platforms.[39m

[38;5;12m- VM monitoring and tools[39m

[38;5;12m  - [39m[38;5;14m[1mAntivmdetect[0m[38;5;12m (https://github.com/nsmfoo/antivmdetection) - Script to create templates to use with VirtualBox to make VM detection harder.[39m
[38;5;12m  - [39m[38;5;14m[1mVMCloak[0m[38;5;12m (https://github.com/hatching/vmcloak) - Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.[39m
[38;5;12m  - [39m[38;5;14m[1mvmitools[0m[38;5;12m (http://libvmi.com/) - C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine.[39m

[38;5;12m- Binary debugger[39m

[38;5;12m  - [39m[38;5;14m[1mHexgolems - Pint Debugger Backend[0m[38;5;12m (https://github.com/hexgolems/pint) - Debugger backend and LUA wrapper for PIN.[39m
[38;5;12m  - [39m[38;5;14m[1mHexgolems - Schem Debugger Frontend[0m[38;5;12m (https://github.com/hexgolems/schem) - Debugger frontend.[39m

[38;5;12m- Mobile Analysis Tool[39m

[38;5;12m  - [39m[38;5;14m[1mAndroguard[0m[38;5;12m (https://github.com/androguard/androguard) - Reverse engineering, Malware and goodware analysis of Android applications and more.[39m
[38;5;12m  - [39m[38;5;14m[1mAPKinspector[0m[38;5;12m (https://github.com/honeynet/apkinspector/) - Powerful GUI tool for analysts to analyze the Android applications.[39m

[38;5;12m- Low interaction honeypot[39m

[38;5;12m  - [39m[38;5;14m[1mHoneyperl[0m[38;5;12m (https://sourceforge.net/projects/honeyperl/) - Honeypot software based in Perl with plugins developed for many functions like : wingates, telnet, squid, smtp, etc.[39m
[38;5;12m  - [39m[38;5;14m[1mT-Pot[0m[38;5;12m (https://github.com/dtag-dev-sec/tpotce) - All in one honeypot appliance from telecom provider T-Mobile[39m
[38;5;12m  - [39m[38;5;14m[1mbeelzebub[0m[38;5;12m (https://github.com/mariocandela/beelzebub) - A secure honeypot framework, extremely easy to configure by yaml 🚀[39m

[38;5;12m- Honeynet data fusion[39m

[38;5;12m  - [39m[38;5;14m[1mHFlow2[0m[38;5;12m (https://projects.honeynet.org/hflow) - Data coalesing tool for honeynet/network analysis.[39m

[38;5;12m- Server[39m

[38;5;12m  - [39m[38;5;14m[1mAmun[0m[38;5;12m (http://amunhoney.sourceforge.net) - Vulnerability emulation honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mArtillery[0m[38;5;12m (https://github.com/trustedsec/artillery/) - Open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.[39m
[38;5;12m  - [39m[38;5;14m[1mBait and Switch[0m[38;5;12m (http://baitnswitch.sourceforge.net) - Redirects all hostile traffic to a honeypot that is partially mirroring your production system.[39m
[38;5;12m  - [39m[38;5;14m[1mBifrozt[0m[38;5;12m (https://github.com/Ziemeck/bifrozt-ansible) - Automatic deploy bifrozt with ansible.[39m
[38;5;12m  - [39m[38;5;14m[1mConpot[0m[38;5;12m (http://conpot.org/) - Low interactive server side Industrial Control Systems honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mHeralding[0m[38;5;12m (https://github.com/johnnykv/heralding) - Credentials catching honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyWRT[0m[38;5;12m (https://github.com/CanadianJeff/honeywrt) - Low interaction Python honeypot designed to mimic services or ports that might get targeted by attackers.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyd[0m[38;5;12m (https://github.com/provos/honeyd) - See [39m[38;5;14m[1mhoneyd tools[0m[38;5;12m (#honeyd-tools).[39m
[38;5;12m  - [39m[38;5;14m[1mHoneysink[0m[38;5;12m (http://www.honeynet.org/node/773) - Open source network sinkhole that provides a mechanism for detection and prevention of malicious traffic on a given network.[39m
[38;5;12m  - [39m[38;5;14m[1mHontel[0m[38;5;12m (https://github.com/stamparm/hontel) - Telnet Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mKFSensor[0m[38;5;12m (http://www.keyfocus.net/kfsensor/) - Windows based honeypot Intrusion Detection System (IDS).[39m
[38;5;12m  - [39m[38;5;14m[1mLaBrea[0m[38;5;12m (http://labrea.sourceforge.net/labrea-info.html) - Takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet.[39m
[38;5;12m  - [39m[38;5;14m[1mMTPot[0m[38;5;12m (https://github.com/Cymmetria/MTPot) - Open Source Telnet Honeypot, focused on Mirai malware.[39m
[38;5;12m  - [39m[38;5;14m[1mSIREN[0m[38;5;12m (https://github.com/blaverick62/SIREN) - Semi-Intelligent HoneyPot Network - HoneyNet Intelligent Virtual Environment.[39m
[38;5;12m  - [39m[38;5;14m[1mTelnetHoney[0m[38;5;12m (https://github.com/balte/TelnetHoney) - Simple telnet honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mUDPot Honeypot[0m[38;5;12m (https://github.com/jekil/UDPot) - Simple UDP/DNS honeypot scripts.[39m
[38;5;12m  - [39m[38;5;14m[1mYet Another Fake Honeypot (YAFH)[0m[38;5;12m (https://github.com/fnzv/YAFH) - Simple honeypot written in Go.[39m
[38;5;12m  - [39m[38;5;14m[1marctic-swallow[0m[38;5;12m (https://github.com/ajackal/arctic-swallow) - Low interaction honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mfapro[0m[38;5;12m (https://github.com/fofapro/fapro) - Fake Protocol Server.[39m
[38;5;12m  - [39m[38;5;14m[1mglutton[0m[38;5;12m (https://github.com/mushorg/glutton) - All eating honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mgo-HoneyPot[0m[38;5;12m (https://github.com/Mojachieee/go-HoneyPot) - Honeypot server written in Go.[39m
[38;5;12m  - [39m[38;5;14m[1mgo-emulators[0m[38;5;12m (https://github.com/kingtuna/go-emulators) - Honeypot Golang emulators.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneymail[0m[38;5;12m (https://github.com/sec51/honeymail) - SMTP honeypot written in Golang.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneytrap[0m[38;5;12m (https://github.com/tillmannw/honeytrap) - Low-interaction honeypot and network security tool written to catch attacks against TCP and UDP services.[39m
[38;5;12m  - [39m[38;5;14m[1mimap-honey[0m[38;5;12m (https://github.com/yvesago/imap-honey) - IMAP honeypot written in Golang.[39m
[38;5;12m  - [39m[38;5;14m[1mmwcollectd[0m[38;5;12m (https://www.openhub.net/p/mwcollectd) - Versatile malware collection daemon, uniting the best features of nepenthes and honeytrap.[39m
[38;5;12m  - [39m[38;5;14m[1mpotd[0m[38;5;12m (https://github.com/lnslbrty/potd) - Highly scalable low- to medium-interaction SSH/TCP honeypot designed for OpenWrt/IoT devices leveraging several Linux kernel features, such as namespaces, seccomp and thread capabilities.[39m
[38;5;12m  - [39m[38;5;14m[1mportlurker[0m[38;5;12m (https://github.com/bartnv/portlurker) - Port listener in Rust with protocol guessing and safe string display.[39m
[38;5;12m  - [39m[38;5;14m[1mslipm-honeypot[0m[38;5;12m (https://github.com/rshipp/slipm-honeypot) - Simple low-interaction port monitoring honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mtelnet-iot-honeypot[0m[38;5;12m (https://github.com/Phype/telnet-iot-honeypot) - Python telnet honeypot for catching botnet binaries.[39m
[38;5;12m  - [39m[38;5;14m[1mtelnetlogger[0m[38;5;12m (https://github.com/robertdavidgraham/telnetlogger) - Telnet honeypot designed to track the Mirai botnet.[39m
[38;5;12m  - [39m[38;5;14m[1mvnclowpot[0m[38;5;12m (https://github.com/magisterquis/vnclowpot) - Low interaction VNC honeypot.[39m

[38;5;12m- IDS signature generation[39m

[38;5;12m  - [39m[38;5;14m[1mHoneycomb[0m[38;5;12m (http://www.icir.org/christian/honeycomb/) - Automated signature creation using honeypots.[39m

[38;5;12m- Lookup service for AS-numbers and prefixes[39m

[38;5;12m  - [39m[38;5;14m[1mCC2ASN[0m[38;5;12m (http://www.cc2asn.com/) - Simple lookup service for AS-numbers and prefixes belonging to any given country in the world.[39m

[38;5;12m- Data Collection / Data Sharing[39m

[38;5;12m  - [39m[38;5;14m[1mHPfriends[0m[38;5;12m (http://hpfriends.honeycloud.net/#/home) - Honeypot data-sharing platform.[39m
[48;5;235m[38;5;249m- **hpfriends - real-time social data-sharing** (https://heipei.io/sigint-hpfriends/) - Presentation about HPFriends feed system[49m[39m
[38;5;12m  - [39m[38;5;14m[1mHPFeeds[0m[38;5;12m (https://github.com/rep/hpfeeds/) - Lightweight authenticated publish-subscribe protocol.[39m

[38;5;12m- Central management tool[39m

[38;5;12m  - [39m[38;5;14m[1mPHARM[0m[38;5;12m (http://www.nepenthespharm.com/) - Manage, report, and analyze your distributed Nepenthes instances.[39m

[38;5;12m- Network connection analyzer[39m

[38;5;12m  - [39m[38;5;14m[1mImpost[0m[38;5;12m (http://impost.sourceforge.net/) - Network security auditing tool designed to analyze the forensics behind compromised and/or vulnerable daemons.[39m

[38;5;12m- Honeypot deployment[39m

[38;5;12m  - [39m[38;5;14m[1mhoneyfs[0m[38;5;12m (https://github.com/referefref/honeyfs) - Tool to create artificial file systems for medium/high interaction honeypots.[39m
[38;5;12m  - [39m[38;5;14m[1mModern Honeynet Network[0m[38;5;12m (http://threatstream.github.io/mhn/) - Streamlines deployment and management of secure honeypots.[39m

[38;5;12m- Honeypot extensions to Wireshark[39m

[38;5;12m  - [39m[38;5;14m[1mWireshark Extensions[0m[38;5;12m (https://www.honeynet.org/project/WiresharkExtensions) - Apply Snort IDS rules and signatures against packet capture files using Wireshark.[39m

[38;5;12m- Client[39m

[38;5;12m  - [39m[38;5;14m[1mCWSandbox / GFI Sandbox[0m[38;5;12m (https://www.gfi.com/products-and-solutions/all-products)[39m
[38;5;12m  - [39m[38;5;14m[1mCapture-HPC-Linux[0m[38;5;12m (https://redmine.honeynet.org/projects/linux-capture-hpc/wiki)[39m
[38;5;12m  - [39m[38;5;14m[1mCapture-HPC-NG[0m[38;5;12m (https://github.com/CERT-Polska/HSN-Capture-HPC-NG)[39m
[38;5;12m  - [39m[38;5;14m[1mCapture-HPC[0m[38;5;12m (https://projects.honeynet.org/capture-hpc) - High interaction client honeypot (also called honeyclient).[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyBOT[0m[38;5;12m (http://www.atomicsoftwaresolutions.com/)[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyC[0m[38;5;12m (https://projects.honeynet.org/honeyc)[39m
[38;5;12m  - [39m[38;5;14m[1mHoneySpider Network[0m[38;5;12m (https://github.com/CERT-Polska/hsn2-bundle) - Highly-scalable system integrating multiple client honeypots to detect malicious websites.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyWeb[0m[38;5;12m (https://code.google.com/archive/p/gsoc-honeyweb/) - Web interface created to manage and remotely share Honeyclients resources.[39m
[38;5;12m  - [39m[38;5;14m[1mJsunpack-n[0m[38;5;12m (https://github.com/urule99/jsunpack-n)[39m
[38;5;12m  - [39m[38;5;14m[1mMonkeySpider[0m[38;5;12m (http://monkeyspider.sourceforge.net)[39m
[38;5;12m  - [39m[38;5;14m[1mPhoneyC[0m[38;5;12m (https://github.com/honeynet/phoneyc) - Python honeyclient (later replaced by Thug).[39m
[38;5;12m  - [39m[38;5;14m[1mPwnypot[0m[38;5;12m (https://github.com/shjalayeri/pwnypot) - High Interaction Client Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mRumal[0m[38;5;12m (https://github.com/thugs-rumal/) - Thug's Rumāl: a Thug's dress and weapon.[39m
[38;5;12m  - [39m[38;5;14m[1mShelia[0m[38;5;12m (https://www.cs.vu.nl/~herbertb/misc/shelia/) - Client-side honeypot for attack detection.[39m
[38;5;12m  - [39m[38;5;14m[1mThug[0m[38;5;12m (https://buffer.github.io/thug/) - Python-based low-interaction honeyclient.[39m
[38;5;12m  - [39m[38;5;14m[1mThug Distributed Task Queuing[0m[38;5;12m (https://thug-distributed.readthedocs.io/en/latest/index.html)[39m
[38;5;12m  - [39m[38;5;14m[1mTrigona[0m[38;5;12m (https://www.honeynet.org/project/Trigona)[39m
[38;5;12m  - [39m[38;5;14m[1mURLQuery[0m[38;5;12m (https://urlquery.net/)[39m
[38;5;12m  - [39m[38;5;14m[1mYALIH (Yet Another Low Interaction Honeyclient)[0m[38;5;12m (https://github.com/Masood-M/yalih) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques.[39m

[38;5;12m- Honeypot[39m

[38;5;12m  - [39m[38;5;14m[1mDeception Toolkit[0m[38;5;12m (http://www.all.net/dtk/dtk.html)[39m
[38;5;12m  - [39m[38;5;14m[1mIMHoneypot[0m[38;5;12m (https://github.com/mushorg/imhoneypot)[39m

[38;5;12m- PDF document inspector[39m

[38;5;12m  - [39m[38;5;14m[1mpeepdf[0m[38;5;12m (https://github.com/jesparza/peepdf) - Powerful Python tool to analyze PDF documents.[39m

[38;5;12m- Hybrid low/high interaction honeypot[39m

[38;5;12m  - [39m[38;5;14m[1mHoneyBrid[0m[38;5;12m (http://honeybrid.sourceforge.net)[39m

[38;5;12m- SSH Honeypots[39m

[38;5;12m  - [39m[38;5;14m[1mBlacknet[0m[38;5;12m (https://github.com/morian/blacknet) - Multi-head SSH honeypot system.[39m
[38;5;12m  - [39m[38;5;14m[1mCowrie[0m[38;5;12m (https://github.com/cowrie/cowrie) - Cowrie SSH Honeypot (based on kippo).[39m
[38;5;12m  - [39m[38;5;14m[1mDShield docker[0m[38;5;12m (https://github.com/xme/dshield-docker) - Docker container running cowrie with DShield output enabled.[39m
[38;5;12m  - [39m[38;5;14m[1mendlessh[0m[38;5;12m (https://github.com/skeeto/endlessh) - SSH tarpit that slowly sends an endless banner. ([39m[38;5;14m[1mdocker image[0m[38;5;12m (https://hub.docker.com/r/linuxserver/endlessh))[39m
[38;5;12m  - [39m[38;5;14m[1mHonSSH[0m[38;5;12m (https://github.com/tnich/honssh) - Logs all SSH communications between a client and server.[39m
[38;5;12m  - [39m[38;5;14m[1mHUDINX[0m[38;5;12m (https://github.com/Cryptix720/HUDINX) - Tiny interaction SSH honeypot engineered in Python to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.[39m
[38;5;12m  - [39m[38;5;14m[1mKippo[0m[38;5;12m (https://github.com/desaster/kippo) - Medium interaction SSH honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mKippo_JunOS[0m[38;5;12m (https://github.com/gregcmartin/Kippo_JunOS) - Kippo configured to be a backdoored netscreen.[39m
[38;5;12m  - [39m[38;5;14m[1mKojoney2[0m[38;5;12m (https://github.com/madirish/kojoney2) - Low interaction SSH honeypot written in Python and based on Kojoney by Jose Antonio Coret.[39m
[38;5;12m  - [39m[38;5;14m[1mKojoney[0m[38;5;12m (http://kojoney.sourceforge.net/) - Python-based Low interaction honeypot that emulates an SSH server implemented with Twisted Conch.[39m
[38;5;12m  - [39m[38;5;14m[1mLongitudinal Analysis of SSH Cowrie Honeypot Logs[0m[38;5;12m (https://github.com/deroux/longitudinal-analysis-cowrie) - Python based command line tool to analyze cowrie logs over time.[39m
[38;5;12m  - [39m[38;5;14m[1mLongTail Log Analysis @ Marist College[0m[38;5;12m (http://longtail.it.marist.edu/honey/) - Analyzed SSH honeypot logs.[39m
[38;5;12m  - [39m[38;5;14m[1mMalbait[0m[38;5;12m (https://github.com/batchmcnulty/Malbait) - Simple TCP/UDP honeypot implemented in Perl.[39m
[38;5;12m  - [39m[38;5;14m[1mMockSSH[0m[38;5;12m (https://github.com/ncouture/MockSSH) - Mock an SSH server and define all commands it supports (Python, Twisted).[39m
[38;5;12m  - [39m[38;5;14m[1mcowrie2neo[0m[38;5;12m (https://github.com/xlfe/cowrie2neo) - Parse cowrie honeypot logs into a neo4j database.[39m
[38;5;12m  - [39m[38;5;14m[1mgo-sshoney[0m[38;5;12m (https://github.com/ashmckenzie/go-sshoney) - SSH Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mgo0r[0m[38;5;12m (https://github.com/fzerorubigd/go0r) - Simple ssh honeypot in Golang.[39m
[38;5;12m  - [39m[38;5;14m[1mgohoney[0m[38;5;12m (https://github.com/PaulMaddox/gohoney) - SSH honeypot written in Go.[39m
[38;5;12m  - [39m[38;5;14m[1mhived[0m[38;5;12m (https://github.com/sahilm/hived) - Golang-based honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mhnypots-agent)[0m[38;5;12m (https://github.com/joshrendek/hnypots-agent) - SSH Server in Go that logs username and password combinations.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneypot.go[0m[38;5;12m (https://github.com/mdp/honeypot.go) - SSH Honeypot written in Go.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneyssh[0m[38;5;12m (https://github.com/ppacher/honeyssh) - Credential dumping SSH honeypot with statistics.[39m
[38;5;12m  - [39m[38;5;14m[1mhornet[0m[38;5;12m (https://github.com/czardoz/hornet) - Medium interaction SSH honeypot that supports multiple virtual hosts.[39m
[38;5;12m  - [39m[38;5;14m[1mssh-auth-logger[0m[38;5;12m (https://github.com/JustinAzoff/ssh-auth-logger) - Low/zero interaction SSH authentication logging honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mssh-honeypot[0m[38;5;12m (https://github.com/droberson/ssh-honeypot) - Fake sshd that logs IP addresses, usernames, and passwords.[39m
[38;5;12m  - [39m[38;5;14m[1mssh-honeypot[0m[38;5;12m (https://github.com/amv42/sshd-honeypot) - Modified version of the OpenSSH deamon that forwards commands to Cowrie where all commands are interpreted and returned.[39m
[38;5;12m  - [39m[38;5;14m[1mssh-honeypotd[0m[38;5;12m (https://github.com/sjinks/ssh-honeypotd) - Low-interaction SSH honeypot written in C.[39m
[38;5;12m  - [39m[38;5;14m[1msshForShits[0m[38;5;12m (https://github.com/traetox/sshForShits) - Framework for a high interaction SSH honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1msshesame[0m[38;5;12m (https://github.com/jaksi/sshesame) - Fake SSH server that lets everyone in and logs their activity.[39m
[38;5;12m  - [39m[38;5;14m[1msshhipot[0m[38;5;12m (https://github.com/magisterquis/sshhipot) - High-interaction MitM SSH honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1msshlowpot[0m[38;5;12m (https://github.com/magisterquis/sshlowpot) - Yet another no-frills low-interaction SSH honeypot in Go.[39m
[38;5;12m  - [39m[38;5;14m[1msshsyrup[0m[38;5;12m (https://github.com/mkishere/sshsyrup) - Simple SSH Honeypot with features to capture terminal activity and upload to asciinema.org.[39m
[38;5;12m  - [39m[38;5;14m[1mtwisted-honeypots[0m[38;5;12m (https://github.com/lanjelot/twisted-honeypots) - SSH, FTP and Telnet honeypots based on Twisted.[39m

[38;5;12m- Distributed sensor project[39m

[38;5;12m  - [39m[38;5;14m[1mDShield Web Honeypot Project[0m[38;5;12m (https://sites.google.com/site/webhoneypotsite/)[39m

[38;5;12m- A pcap analyzer[39m

[38;5;12m  - [39m[38;5;14m[1mHoneysnap[0m[38;5;12m (https://projects.honeynet.org/honeysnap/)[39m

[38;5;12m- Network traffic redirector[39m

[38;5;12m  - [39m[38;5;14m[1mHoneywall[0m[38;5;12m (https://projects.honeynet.org/honeywall/)[39m

[38;5;12m- Honeypot Distribution with mixed content[39m

[38;5;12m  - [39m[38;5;14m[1mHoneyDrive[0m[38;5;12m (https://bruteforcelab.com/honeydrive)[39m

[38;5;12m- Honeypot sensor[39m

[38;5;12m  - [39m[38;5;14m[1mHoneeepi[0m[38;5;12m (https://redmine.honeynet.org/projects/honeeepi/wiki) - Honeypot sensor on a Raspberry Pi based on a customized Raspbian OS.[39m

[38;5;12m- File carving[39m

[38;5;12m  - [39m[38;5;14m[1mTestDisk & PhotoRec[0m[38;5;12m (https://www.cgsecurity.org/)[39m

[38;5;12m- Behavioral analysis tool for win32[39m

[38;5;12m  - [39m[38;5;14m[1mCapture BAT[0m[38;5;12m (https://www.honeynet.org/node/315)[39m

[38;5;12m- Live CD[39m

[38;5;12m  - [39m[38;5;14m[1mDAVIX[0m[38;5;12m (https://www.secviz.org/node/89) - The DAVIX Live CD.[39m

[38;5;12m- Spamtrap[39m

[38;5;12m  - [39m[38;5;14m[1mMail::SMTP::Honeypot[0m[38;5;12m (https://metacpan.org/pod/release/MIKER/Mail-SMTP-Honeypot-0.11/Honeypot.pm) - Perl module that appears to provide the functionality of a standard SMTP server.[39m
[38;5;12m  - [39m[38;5;14m[1mMailoney[0m[38;5;12m (https://github.com/awhitehatter/mailoney) - SMTP honeypot, Open Relay, Cred Harvester written in python.[39m
[38;5;12m  - [39m[38;5;14m[1mSendMeSpamIDS.py[0m[38;5;12m (https://github.com/johestephan/VerySimpleHoneypot) - Simple SMTP fetch all IDS and analyzer.[39m
[38;5;12m  - [39m[38;5;14m[1mShiva[0m[38;5;12m (https://github.com/shiva-spampot/shiva) - Spam Honeypot with Intelligent Virtual Analyzer.[39m
[48;5;235m[38;5;249m- **Shiva The Spam Honeypot Tips And Tricks For Getting It Up And Running** (https://www.pentestpartners.com/security-blog/shiva-the-spam-honeypot-tips-and-tricks-for-getting-it-up-and-running/)[49m[39m
[38;5;12m  - [39m[38;5;14m[1mSMTPLLMPot[0m[38;5;12m (https://github.com/referefref/SMTPLLMPot) - A super simple SMTP Honeypot built using GPT3.5[39m
[38;5;12m  - [39m[38;5;14m[1mSpamHAT[0m[38;5;12m (https://github.com/miguelraulb/spamhat) - Spam Honeypot Tool.[39m
[38;5;12m  - [39m[38;5;14m[1mSpamhole[0m[38;5;12m (http://www.spamhole.net/)[39m
[38;5;12m  - [39m[38;5;14m[1mhoneypot[0m[38;5;12m (https://github.com/jadb/honeypot) - The Project Honey Pot un-official PHP SDK.[39m
[38;5;12m  - [39m[38;5;14m[1mspamd[0m[38;5;12m (http://man.openbsd.org/cgi-bin/man.cgi?query=spamd%26apropos=0%26sektion=0%26manpath=OpenBSD+Current%26arch=i386%26format=html)[39m

[38;5;12m- Commercial honeynet[39m

[38;5;12m  - [39m[38;5;14m[1mCymmetria Mazerunner[0m[38;5;12m (ttps://cymmetria.com/products/mazerunner/) - Leads attackers away from real targets and creates a footprint of the attack.[39m

[38;5;12m- Server (Bluetooth)[39m

[38;5;12m  - [39m[38;5;14m[1mBluepot[0m[38;5;12m (https://github.com/andrewmichaelsmith/bluepot)[39m

[38;5;12m- Dynamic analysis of Android apps[39m

[38;5;12m  - [39m[38;5;14m[1mDroidbox[0m[38;5;12m (https://code.google.com/archive/p/droidbox/)[39m

[38;5;12m- Dockerized Low Interaction packaging[39m

[38;5;12m  - [39m[38;5;14m[1mDocker honeynet[0m[38;5;12m (https://github.com/sreinhardt/Docker-Honeynet) - Several Honeynet tools set up for Docker containers.[39m
[38;5;12m  - [39m[38;5;14m[1mDockerized Thug[0m[38;5;12m (https://hub.docker.com/r/honeynet/thug/) - Dockerized [39m[38;5;14m[1mThug[0m[38;5;12m (https://github.com/buffer/thug) to analyze malicious web content.[39m
[38;5;12m  - [39m[38;5;14m[1mDockerpot[0m[38;5;12m (https://github.com/mrschyte/dockerpot) - Docker based honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mManuka[0m[38;5;12m (https://github.com/andrewmichaelsmith/manuka) - Docker based honeypot (Dionaea and Kippo).[39m
[38;5;12m  - [39m[38;5;14m[1mhoney_ports[0m[38;5;12m (https://github.com/run41/honey_ports) - Very simple but effective docker deployed honeypot to detect port scanning in your environment.[39m
[38;5;12m  - [39m[38;5;14m[1mmhn-core-docker[0m[38;5;12m (https://github.com/MattCarothers/mhn-core-docker) - Core elements of the Modern Honey Network implemented in Docker.[39m

[38;5;12m- Network analysis[39m

[38;5;12m  - [39m[38;5;14m[1mQuechua[0m[38;5;12m (https://bitbucket.org/zaccone/quechua)[39m

[38;5;12m- SIP Server[39m

[38;5;12m  - [39m[38;5;14m[1mArtemnesia VoIP[0m[38;5;12m (http://artemisa.sourceforge.net)[39m

[38;5;12m- SIP[39m

[38;5;12m  - [39m[38;5;14m[1mSentryPeer[0m[38;5;12m (https://github.com/SentryPeer/SentryPeer) - Protect your SIP Servers from bad actors.[39m

[38;5;12m- IOT Honeypot[39m

[38;5;12m  - [39m[38;5;14m[1mHoneyThing[0m[38;5;12m (https://github.com/omererdem/honeything) - TR-069 Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mKako[0m[38;5;12m (https://github.com/darkarnium/kako) - Honeypots for a number of well known and deployed embedded device vulnerabilities.[39m

[38;5;12m- Honeytokens[39m
[38;5;12m  - [39m[38;5;14m[1mCanaryTokens[0m[38;5;12m (https://github.com/thinkst/canarytokens) - Self-hostable honeytoken generator and reporting dashboard; demo version available at [39m[38;5;14m[1mCanaryTokens.org[0m[38;5;12m (https://canarytokens.org/generate).[39m
[38;5;12m  [39m[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mHoneybits[0m[38;5;12m [39m[38;5;12m(https://github.com/0x4D31/honeybits)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mSimple[39m[38;5;12m [39m[38;5;12mtool[39m[38;5;12m [39m[38;5;12mdesigned[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12menhance[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12meffectiveness[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m[38;5;12mtraps[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mspreading[39m[38;5;12m [39m[38;5;12mbreadcrumbs[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mhoneytokens[39m[38;5;12m [39m[38;5;12macross[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m[38;5;12mproduction[39m[38;5;12m [39m[38;5;12mservers[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mworkstations[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mlure[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mattacker[39m[38;5;12m [39m[38;5;12mtoward[39m[38;5;12m [39m
[38;5;12myour[39m[38;5;12m [39m[38;5;12mhoneypots.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyλ (HoneyLambda)[0m[38;5;12m (https://github.com/0x4D31/honeylambda) - Simple, serverless application designed to create and monitor URL honeytokens, on top of AWS Lambda and Amazon API Gateway.[39m
[38;5;12m  - [39m[38;5;14m[1mdcept[0m[38;5;12m (https://github.com/secureworks/dcept) - Tool for deploying and detecting use of Active Directory honeytokens.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneyku[0m[38;5;12m (https://github.com/0x4D31/honeyku) - Heroku-based web honeypot that can be used to create and monitor fake HTTP endpoints (i.e. honeytokens).[39m

[38;2;255;187;0m[4mHoneyd Tools[0m

[38;5;12m- Honeyd plugin[39m

[38;5;12m  - [39m[38;5;14m[1mHoneycomb[0m[38;5;12m (http://www.honeyd.org/tools.php)[39m

[38;5;12m- Honeyd viewer[39m

[38;5;12m  - [39m[38;5;14m[1mHoneyview[0m[38;5;12m (http://honeyview.sourceforge.net/)[39m

[38;5;12m- Honeyd to MySQL connector[39m

[38;5;12m  - [39m[38;5;14m[1mHoneyd2MySQL[0m[38;5;12m (https://bruteforcelab.com/honeyd2mysql)[39m

[38;5;12m- A script to visualize statistics from honeyd[39m

[38;5;12m  - [39m[38;5;14m[1mHoneyd-Viz[0m[38;5;12m (https://bruteforcelab.com/honeyd-viz)[39m

[38;5;12m- Honeyd stats[39m
[38;5;12m  - [39m[38;5;14m[1mHoneydsum.pl[0m[38;5;12m (https://github.com/DataSoft/Honeyd/blob/master/scripts/misc/honeydsum-v0.3/honeydsum.pl)[39m

[38;2;255;187;0m[4mNetwork and Artifact Analysis[0m

[38;5;12m- Sandbox[39m

[38;5;12m  - [39m[38;5;14m[1mArgos[0m[38;5;12m (http://www.few.vu.nl/argos/) - Emulator for capturing zero-day attacks.[39m
[38;5;12m  - [39m[38;5;14m[1mCOMODO automated sandbox[0m[38;5;12m (https://help.comodo.com/topic-72-1-451-4768-.html)[39m
[38;5;12m  - [39m[38;5;14m[1mCuckoo[0m[38;5;12m (https://cuckoosandbox.org/) - Leading open source automated malware analysis system.[39m
[38;5;12m  - [39m[38;5;14m[1mPylibemu[0m[38;5;12m (https://github.com/buffer/pylibemu) - Libemu Cython wrapper.[39m
[38;5;12m  - [39m[38;5;14m[1mRFISandbox[0m[38;5;12m (https://monkey.org/~jose/software/rfi-sandbox/) - PHP 5.x script sandbox built on top of [39m[38;5;14m[1mfuncall[0m[38;5;12m (https://pecl.php.net/package/funcall).[39m
[38;5;12m  - [39m[38;5;14m[1mdorothy2[0m[38;5;12m (https://github.com/m4rco-/dorothy2) - Malware/botnet analysis framework written in Ruby.[39m
[38;5;12m  - [39m[38;5;14m[1mimalse[0m[38;5;12m (https://github.com/hbhzwj/imalse) - Integrated MALware Simulator and Emulator.[39m
[38;5;12m  - [39m[38;5;14m[1mlibemu[0m[38;5;12m (https://github.com/buffer/libemu) - Shellcode emulation library, useful for shellcode detection.[39m

[38;5;12m- Sandbox-as-a-Service[39m

[38;5;12m  - [39m[38;5;14m[1mHybrid Analysis[0m[38;5;12m (https://www.hybrid-analysis.com) - Free malware analysis service powered by Payload Security that detects and analyzes unknown threats using a unique Hybrid Analysis technology.[39m
[38;5;12m  - [39m[38;5;14m[1mJoebox Cloud[0m[38;5;12m (https://jbxcloud.joesecurity.org/login) - Analyzes the behavior of malicious files including PEs, PDFs, DOCs, PPTs, XLSs, APKs, URLs and MachOs on Windows, Android and Mac OS X for suspicious activities.[39m
[38;5;12m  - [39m[38;5;14m[1mVirusTotal[0m[38;5;12m (https://www.virustotal.com/) - Analyze suspicious files and URLs to detect types of malware, and automatically share them with the security community.[39m
[38;5;12m  - [39m[38;5;14m[1mmalwr.com[0m[38;5;12m (https://malwr.com/) - Free malware analysis service and community.[39m

[38;2;255;187;0m[4mData Tools[0m

[38;5;12m- Front Ends[39m

[38;5;12m  - [39m[38;5;14m[1mDionaeaFR[0m[38;5;12m (https://github.com/rubenespadas/DionaeaFR) - Front Web to Dionaea low-interaction honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mDjango-kippo[0m[38;5;12m (https://github.com/jedie/django-kippo) - Django App for kippo SSH Honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mShockpot-Frontend[0m[38;5;12m (https://github.com/GovCERT-CZ/Shockpot-Frontend) - Full featured script to visualize statistics from a Shockpot honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mTango[0m[38;5;12m (https://github.com/aplura/Tango) - Honeypot Intelligence with Splunk.[39m
[38;5;12m  - [39m[38;5;14m[1mWordpot-Frontend[0m[38;5;12m (https://github.com/GovCERT-CZ/Wordpot-Frontend) - Full featured script to visualize statistics from a Wordpot honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneyalarmg2[0m[38;5;12m (https://github.com/schmalle/honeyalarmg2) - Simplified UI for showing honeypot alarms.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneypotDisplay[0m[38;5;12m (https://github.com/Joss-Steward/honeypotDisplay) - Flask website which displays data gathered from an SSH Honeypot.[39m

[38;5;12m- Visualization[39m

[38;5;12m  - [39m[38;5;14m[1mAcapulco[0m[38;5;12m (https://github.com/hgascon/acapulco) - Automated Attack Community Graph Construction.[39m
[38;5;12m  - [39m[38;5;14m[1mAfterglow Cloud[0m[38;5;12m (https://github.com/ayrus/afterglow-cloud)[39m
[38;5;12m  - [39m[38;5;14m[1mAfterglow[0m[38;5;12m (http://afterglow.sourceforge.net/)[39m
[38;5;12m  - [39m[38;5;14m[1mGlastopf Analytics[0m[38;5;12m (https://github.com/katkad/Glastopf-Analytics) - Easy honeypot statistics.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyMalt[0m[38;5;12m (https://github.com/SneakersInc/HoneyMalt) - Maltego tranforms for mapping Honeypot systems.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyMap[0m[38;5;12m (https://github.com/fw42/honeymap) - Real-time websocket stream of GPS events on a fancy SVG world map.[39m
[38;5;12m  - [39m[38;5;14m[1mHoneyStats[0m[38;5;12m (https://sourceforge.net/projects/honeystats/) - Statistical view of the recorded activity on a Honeynet.[39m
[38;5;12m  - [39m[38;5;14m[1mHpfeedsHoneyGraph[0m[38;5;12m (https://github.com/yuchincheng/HpfeedsHoneyGraph) - Visualization app to visualize hpfeeds logs.[39m
[38;5;12m  [39m[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mIVRE[0m[38;5;12m [39m[38;5;12m(https://github.com/ivre/ivre)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mNetwork[39m[38;5;12m [39m[38;5;12mrecon[39m[38;5;12m [39m[38;5;12mframework,[39m[38;5;12m [39m[38;5;12mpublished[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12m@cea-sec[39m[38;5;12m [39m[38;5;12m&[39m[38;5;12m [39m[38;5;12m@ANSSI-FR.[39m[38;5;12m [39m[38;5;12mBuild[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m[38;5;12mown,[39m[38;5;12m [39m[38;5;12mself-hosted[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mfully-controlled[39m[38;5;12m [39m[38;5;12malternatives[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mCriminalip[39m[38;5;12m [39m[38;5;12m/[39m[38;5;12m [39m[38;5;12mShodan[39m[38;5;12m [39m[38;5;12m/[39m[38;5;12m [39m[38;5;12mZoomEye[39m[38;5;12m [39m[38;5;12m/[39m[38;5;12m [39m[38;5;12mCensys[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mGreyNoise,[39m[38;5;12m [39m[38;5;12mrun[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m
[38;5;12mPassive[39m[38;5;12m [39m[38;5;12mDNS[39m[38;5;12m [39m[38;5;12mservice,[39m[38;5;12m [39m[38;5;12mcollect[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12manalyse[39m[38;5;12m [39m[38;5;12mnetwork[39m[38;5;12m [39m[38;5;12mintelligence[39m[38;5;12m [39m[38;5;12mfrom[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m[38;5;12msensors,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mmuch[39m[38;5;12m [39m[38;5;12mmore![39m
[38;5;12m  - [39m[38;5;14m[1mKippo stats[0m[38;5;12m (https://github.com/mfontani/kippo-stats) - Mojolicious app to display statistics for your kippo SSH honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mKippo-Graph[0m[38;5;12m (https://bruteforcelab.com/kippo-graph) - Full featured script to visualize statistics from a Kippo SSH honeypot.[39m
[38;5;12m  - [39m[38;5;14m[1mThe Intelligent HoneyNet[0m[38;5;12m (https://github.com/jpyorre/IntelligentHoneyNet) - Create actionable information from honeypots.[39m
[38;5;12m  - [39m[38;5;14m[1movizart[0m[38;5;12m (https://github.com/oguzy/ovizart) - Visual analysis for network traffic.[39m

[38;2;255;187;0m[4mGuides[0m

[38;5;12m- [39m[38;5;14m[1mT-Pot: A Multi-Honeypot Platform[0m[38;5;12m (https://dtag-dev-sec.github.io/mediator/feature/2015/03/17/concept.html)[39m
[38;5;12m- [39m[38;5;14m[1mHoneypot (Dionaea and kippo) setup script[0m[38;5;12m (https://github.com/andrewmichaelsmith/honeypot-setup-script/)[39m

[38;5;12m- Deployment[39m

[38;5;12m  - [39m[38;5;14m[1mDionaea and EC2 in 20 Minutes[0m[38;5;12m (http://andrewmichaelsmith.com/2012/03/dionaea-honeypot-on-ec2-in-20-minutes/) - Tutorial on setting up Dionaea on an EC2 instance.[39m
[38;5;12m  [39m[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mUsing[0m[38;5;14m[1m [0m[38;5;14m[1ma[0m[38;5;14m[1m [0m[38;5;14m[1mRaspberry[0m[38;5;14m[1m [0m[38;5;14m[1mPi[0m[38;5;14m[1m [0m[38;5;14m[1mhoneypot[0m[38;5;14m[1m [0m[38;5;14m[1mto[0m[38;5;14m[1m [0m[38;5;14m[1mcontribute[0m[38;5;14m[1m [0m[38;5;14m[1mdata[0m[38;5;14m[1m [0m[38;5;14m[1mto[0m[38;5;14m[1m [0m[38;5;14m[1mDShield/ISC[0m[38;5;12m [39m[38;5;12m(https://isc.sans.edu/diary/22680)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mThe[39m[38;5;12m [39m[38;5;12mRaspberry[39m[38;5;12m [39m[38;5;12mPi[39m[38;5;12m [39m[38;5;12mbased[39m[38;5;12m [39m[38;5;12msystem[39m[38;5;12m [39m[38;5;12mwill[39m[38;5;12m [39m[38;5;12mallow[39m[38;5;12m [39m[38;5;12mus[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mmaintain[39m[38;5;12m [39m[38;5;12mone[39m[38;5;12m [39m[38;5;12mcode[39m[38;5;12m [39m[38;5;12mbase[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mwill[39m[38;5;12m [39m[38;5;12mmake[39m[38;5;12m [39m[38;5;12mit[39m[38;5;12m [39m[38;5;12measier[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mcollect[39m[38;5;12m [39m[38;5;12mrich[39m[38;5;12m [39m[38;5;12mlogs[39m[38;5;12m [39m[38;5;12mbeyond[39m[38;5;12m [39m[38;5;12mfirewall[39m
[38;5;12mlogs.[39m
[38;5;12m  - [39m[38;5;14m[1mhoneypotpi[0m[38;5;12m (https://github.com/free5ty1e/honeypotpi) - Script for turning a Raspberry Pi into a HoneyPot Pi.[39m

[38;5;12m- Research Papers[39m

[38;5;12m  - [39m[38;5;14m[1mHoneypot research papers[0m[38;5;12m (https://github.com/shbhmsingh72/Honeypot-Research-Papers) - PDFs of research papers on honeypots.[39m
[38;5;12m  - [39m[38;5;14m[1mvEYE[0m[38;5;12m (https://link.springer.com/article/10.1007%2Fs10115-008-0137-3) - Behavioral footprinting for self-propagating worm detection and profiling.[39m
