A low-interaction honeypot that emulates vulnerable services to capture malware and analyze attacks.
Dionaea is a low-interaction honeypot that emulates vulnerable network services to attract and capture malware, shellcodes, and attack payloads. It is designed as a successor to Nepenthes, with enhanced capabilities for detecting and analyzing malicious activity across multiple protocols. The project helps security researchers and network defenders gather threat intelligence by simulating exploitable targets in a controlled environment.
Security researchers, network administrators, and cybersecurity professionals who need to monitor attack patterns, capture malware samples, or analyze network threats in a safe, controlled manner.
Developers choose Dionaea for its extensive protocol support, built-in shellcode detection via libemu, and Python-based extensibility, making it a versatile and modern honeypot solution for threat intelligence gathering.
Home of the dionaea honeypot
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports over 12 protocols including FTP, HTTP, SMB, and MQTT, as listed in the README, enabling capture of diverse network-based attacks.
Integrates libemu to automatically detect and analyze shellcodes in captured traffic, enhancing threat intelligence without additional tools.
Embeds Python as a scripting language, allowing custom module development and adaptation to specific monitoring needs, per the project philosophy.
Includes IPv6 and TLS support, ensuring compatibility with contemporary network environments and attack vectors.
Offers multiple backends like JSON, SQLite, and HPFeeds, facilitating integration with data analysis tools and security systems.
Uses GPLv2+ but includes components under incompatible licenses like CNRI Python License for the TFTP service, complicating redistribution and compliance.
Requires Python scripting knowledge and manual configuration for protocols, making it less accessible for out-of-the-box use compared to simpler honeypots.
As a low-interaction honeypot, it focuses on emulation and logging rather than active response, which may not suffice for immediate threat mitigation needs.