How do I test attacks on miniprint?

You can use the PRET tool with the command 'python ./pret.py localhost pjl' to interactively attack miniprint on localhost, as specified in the usage section for simulating printer attacks.

What protocols does miniprint support?

miniprint only supports raw PJL on port 9100; it does not support Web, IPP, or LPD protocols, limiting its use to specific printer attack vectors as shown in the protocol support table.

Can miniprint handle PostScript files reliably?

It saves PostScript files to the uploads directory, but has a known issue where files without %%EOF cause indefinite waiting, requiring monitoring or manual fixes for uninterrupted operation.

miniprint vs other honeypots like Dionaea?

miniprint is specialized for printer attacks with medium interaction via PJL and virtual filesystem, while Dionaea is a general low-interaction honeypot. miniprint excels in printer realism but lacks multi-protocol support.

How to customize the virtual filesystem in miniprint?

The README doesn't provide customization details; you likely need to modify the server.py code directly, which requires Python programming skills and understanding of the virtual filesystem implementation.

Is miniprint safe for production networks?

Yes, it's designed with a virtual filesystem to prevent host changes, but deploy it cautiously as a honeypot to avoid attracting malicious traffic or legal issues in sensitive environments.

Open-Awesome

miniprint

GPL-3.0Python

A medium interaction printer honeypot that mimics an exposed network printer to detect and log attacks.

GitHub

202 stars20 forks0 contributors

What is miniprint?

miniprint is a medium interaction printer honeypot that mimics a standard networked printer exposed to the internet. It speaks the Printer Job Language (PJL) protocol to attract and log attacks, helping security researchers analyze threats targeting printing infrastructure. The tool captures print jobs and simulates a virtual filesystem to engage attackers without risking the host system.

Target Audience

Security researchers, penetration testers, and network administrators who want to detect and study attacks on networked printers or deploy honeypots in their environments.

Value Proposition

miniprint offers a specialized, realistic printer honeypot with detailed logging and virtual filesystem interaction, making it a valuable tool for understanding printer-specific attack vectors without the complexity of full hardware emulation.

Overview

A medium interaction printer honeypot 🍯

Use Cases

Best For

Detecting and analyzing attacks on exposed network printers
Security research on printer-specific vulnerabilities and protocols
Deploying honeypots in corporate or lab environments to monitor threats
Educational purposes for learning about printer security and honeypot design
Capturing malicious print jobs for forensic analysis
Simulating medium interaction honeypots with specific protocol support

Not Ideal For

Organizations needing a functional network printer for daily office operations
Projects requiring support for multiple printer protocols like IPP, LPD, or web interfaces
Environments where robust PostScript file handling is critical without manual monitoring
Teams seeking a low-interaction honeypot with minimal logging and resource usage

Pros & Cons

Pros

Virtual Filesystem Safety

Provides a fully-featured virtual filesystem where attackers can read and write files without affecting the host system, ensuring no actual changes are made.

Detailed Forensic Logging

Generates extensive logs in a structured format (time - loglevel - method - operation - message) saved to miniprint.log by default, aiding in security analysis and forensics.

Realistic PJL Protocol

Implements Printer Job Language (PJL) over raw network port 9100, mimicking standard printer behavior to effectively attract and engage attackers.

Print Job Capture

Saves PostScript or plaintext print jobs to an uploads directory for analysis, allowing researchers to examine malicious content without risk.

Cons

Limited Protocol Support

Only supports raw PJL on port 9100; lacks common protocols like IPP, LPD, and web interfaces, which reduces its realism for broader printer attack scenarios.

PostScript Handling Issues

Known to wait indefinitely for PostScript files that don't contain %%EOF, as noted in the README, which can disrupt logging and require manual intervention.

Python Dependency Complexity

Requires Python >=3.5 and a virtual environment setup, which may add overhead for users unfamiliar with Python or in restricted deployment environments.

Frequently Asked Questions

Related Projects

T-Pot

🍯 T-Pot - The All In One Multi Honeypot Platform 🐝

Stars9,467

Forks1,388

Last commit4 days ago

Endlessh

SSH tarpit that slowly sends an endless banner

Stars8,546

Forks302

Last commit2 years ago

Cowrie

Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

Reverse engineering and pentesting for Android applications

Stars6,232

Forks1,151