A signature-based, multi-threaded honeypot detection tool written in Go that identifies emulated services via crafted requests.
honeydet is a signature-based honeypot detection tool written in Go that identifies emulated services by sending crafted requests and analyzing responses. It solves the problem of distinguishing real network services from honeypots, which is essential for accurate security assessments and threat intelligence.
Security researchers, penetration testers, and network administrators who need to detect honeypots during reconnaissance or threat intelligence gathering.
Developers choose honeydet for its high-performance multi-threaded scanning, extensible signature system, and multiple deployment options (CLI, web server, API), making it a versatile tool for honeypot detection in various environments.
Signature based honeypot detector tool written in Golang
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses multi-threading to scan a /24 subnet in approximately one second, enabling rapid network sweeps for efficiency in large-scale assessments.
Can run as a command-line tool, web server, or web API, allowing integration into various workflows such as automated pipelines or manual testing.
Supports custom YAML signatures with multi-step, hex, string, and regex matching for TCP/UDP, enabling users to adapt detection to new honeypots.
Features a SQL backend with a web UI for persistent scan storage, search, pagination, and export, simplifying result analysis and collaboration.
Automatically enriches scan results with Shodan API information for non-private IPs, enhancing threat intelligence when the flag is set in CLI mode.
Key features like the Shodan integration flag are only available in the CLI version, limiting the web UI's functionality for comprehensive scans.
SSL support is absent from the current implementation, as noted in the wish-list, which could expose web server communications to interception.
Requires root privileges for active port detection without Shodan, and passive detection is still on the to-do list, restricting stealthy operations.
Detection accuracy hinges on manually updated YAML signatures, which may lag behind new honeypot deployments and require ongoing community contributions.