Honeyλ (HoneyLambda)
A serverless application to create and monitor fake HTTP endpoints (URL honeytokens) on AWS Lambda and API Gateway.
What is Honeyλ (HoneyLambda)?
honeyλ is a serverless application that creates and monitors fake HTTP endpoints, known as URL honeytokens, to detect malicious activity. It automatically deploys on AWS Lambda and API Gateway, providing alerts via Slack, email, or SMS when a trap is triggered. The tool helps identify attackers, malicious insiders, content scrapers, or bad bots by placing these tokens in documents, emails, or web pages.
Security engineers, DevOps professionals, and cloud administrators looking to implement lightweight, automated threat detection in serverless environments. It's also suitable for organizations needing cost-effective, scalable honeytoken deployment without managing infrastructure.
Developers choose honeyλ for its simplicity, serverless architecture, and pay-per-use model, eliminating the need to manage servers. It offers flexible alerting, threat intelligence integration, and customizable responses, making it a versatile tool for proactive security monitoring in cloud-native setups.
Overview
honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS Lambda and Amazon API Gateway
Use Cases
Best For
- Deploying automated honeytokens in AWS serverless environments
- Detecting malicious bots or scrapers via fake HTTP endpoints
- Monitoring for insider threats using hidden URL traps in documents
- Setting up lightweight threat detection with Slack or email alerts
- Integrating threat intelligence feeds for source IP analysis
- Creating tracking pixels for email or web page monitoring
Not Ideal For
- Teams deploying on cloud providers other than AWS without willingness to modify the Lambda function code
- Projects requiring advanced HTTP client fingerprinting capabilities immediately, as it's a pending feature
- Organizations with strict data privacy policies that prohibit using third-party APIs like Cymon or Twilio
- Small teams lacking AWS operational expertise for manual API Gateway binary support configuration
Pros & Cons
Pros
Built on AWS Lambda and API Gateway with a pay-per-use model, eliminating server management costs and scaling automatically, as highlighted in the README's 'pay-what-you-use' description.
Integrates Slack, email, and SMS via Twilio for real-time notifications when honeytokens are triggered, providing flexible monitoring options as shown in the setup instructions.
Allows customization of HTTP responses per token, including binary data like tracking pixels, though it requires manual API Gateway configuration for binary media types.
Enhances alerts by looking up source IPs against Cymon API v2 feeds, adding context to detections as demonstrated in the Slack alert screenshot.
Cons
Requires manual steps in AWS API Gateway console to enable binary media types for image responses, adding deployment complexity and potential for errors.
Although provider-agnostic via Serverless framework, it's only tested on AWS, and the README admits the main function may need changes for other providers.
Relies on external services like Slack, Twilio, and Cymon, which introduce points of failure and require separate account setups, increasing operational overhead.
Frequently Asked Questions
Related Projects
T-Pot🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
EndlesshSSH tarpit that slowly sends an endless banner
AndroguardReverse engineering and pentesting for Android applications
OpenCanaryModular and decentralised honeypot
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.