HoneyWRT

HoneyWRT is a low-interaction honeypot written in Python that simulates various network services and ports commonly targeted by attackers. It listens on specified ports and logs any connection attempts, helping security teams detect and analyze intrusion activities without exposing real systems.

Key Features

• Service Emulation — Mimics services like RDP (3389), VNC (5900), MSSQL (1433), Telnet (23), and others to attract attackers.
• Customizable Configuration — Users can enable or disable specific services via a configuration file by commenting out lines.
• Extensible Design — Includes documentation for creating custom fake services to expand detection capabilities.
• Flexible Logging — Logs attacker interactions to files, with plans for database integration (SQLite/MySQL).
• Root or Non-Root Operation — Can run as root for low-port emulation or be adjusted for non-privileged use with port forwarding.

Philosophy

HoneyWRT is designed as a lightweight, adaptable intrusion detection tool that prioritizes simplicity and extensibility, allowing security practitioners to deploy deceptive services with minimal overhead.