A proof-of-concept tool that spreads deceptive breadcrumbs and honeytokens across systems to lure attackers toward honeypots.
Honeybits is a proof-of-concept security tool that automates the creation of deceptive artifacts called breadcrumbs and honeytokens across production systems. It enhances traditional honeypots by planting misleading information that responds to attacker post-compromise techniques, luring them toward monitored traps. The tool addresses the limitation of static honeypots by increasing interaction opportunities during credential access, discovery, and lateral movement activities.
Security researchers, red teams, and blue teams looking to improve honeypot effectiveness in production environments. It's particularly useful for organizations wanting to study attacker behavior through deception techniques.
Developers choose Honeybits because it automates the creation of realistic-looking deceptive artifacts across multiple system locations, integrates with existing monitoring tools like auditd, and supports remote configuration management. Its template-based approach allows customization while reducing the manual effort typically required for honeypot deployment.
A PoC tool designed to enhance the effectiveness of your traps by spreading breadcrumbs & honeytokens across your systems to lure the attacker toward your honeypots
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Generates fake bash history, AWS credentials, and configuration files automatically, reducing manual effort in deploying honeytokens across systems.
Uses templates to create realistic-looking honeyfiles, allowing for customizable and convincing deceptive artifacts tailored to specific environments.
Supports integration with go-audit or auditd to monitor access to honeyfiles, enabling real-time intrusion detection and alerting.
Can read configuration from remote key/value stores like Consul or etcd, facilitating centralized management in distributed or cloud environments.
Author explicitly states the code is 'crap' and needs a complete rewrite, indicating instability, potential bugs, and lack of production readiness.
The TODO list includes many missing features like beacon documents and network traps, limiting its current capabilities and requiring custom work for advanced use.
Documentation is listed as incomplete in the TODO, making setup, configuration, and troubleshooting difficult for users without deep expertise.