galah
An LLM-powered web honeypot that dynamically crafts realistic HTTP responses to mimic various applications and detect malicious traffic.
What is galah?
Galah is an LLM-powered web honeypot designed to mimic various web applications by dynamically generating realistic HTTP responses to incoming requests. It solves the problem of static, easily detectable honeypots by using large language models to craft contextually appropriate replies, helping security teams detect and analyze malicious web traffic. The project includes features like response caching and Suricata rule matching for enhanced efficiency and threat detection.
Security researchers, penetration testers, and blue team defenders who need to deploy deceptive systems to monitor attack patterns and gather threat intelligence on web-based exploits.
Developers choose Galah over traditional honeypots because it dynamically adapts to any HTTP request without manual configuration, supports multiple LLM providers for flexibility, and reduces operational costs through intelligent response caching.
Overview
Galah: An LLM-powered web honeypot.
Use Cases
Best For
- Deploying deceptive web services to catch scanning and exploitation attempts
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
