ADBHoney
A low-interaction honeypot that mimics Android Debug Bridge (ADB) over TCP/IP to capture malware targeting exposed port 5555.
What is ADBHoney?
ADBHoney is a low-interaction honeypot that emulates the Android Debug Bridge (ADB) protocol over TCP/IP to detect and analyze attacks targeting devices with exposed port 5555. It logs attacker commands and captures uploaded files, helping security researchers understand malware distribution methods. The project addresses the security risk of unauthenticated ADB over TCP, which can allow complete device compromise.
Security researchers, penetration testers, and network administrators monitoring for threats against Android devices or IoT systems with exposed ADB services.
It provides a simple, resource-efficient way to gather threat intelligence on ADB-based attacks, with Docker support for easy deployment and customizable responses to enhance deception.
Overview
Low interaction honeypot designed for Android Debug Bridge over TCP/IP
Use Cases
Best For
- Monitoring networks for unauthorized ADB connections
- Capturing malware samples uploaded via ADB push commands
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
