An open-source telnet honeypot designed to detect and fingerprint IoT botnets like Mirai by simulating vulnerable devices.
MTPot is an open-source telnet honeypot that simulates vulnerable IoT devices to detect and fingerprint malicious botnet scanners. It helps security researchers identify attacks like Mirai by logging command sequences and attacker IPs, providing insights into IoT threat landscapes.
Security researchers, network defenders, and IoT administrators looking to monitor telnet-based attack attempts and gather threat intelligence on IoT botnets.
Developers choose MTPot for its simplicity, configurable command-response system, and focused approach to telnet-based IoT botnet detection, offering a lightweight alternative to complex honeypot frameworks.
Open Source Telnet Honeypot
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
MTPot is designed for minimal setup with configurable JSON files, making it easy to deploy for focused telnet emulation without complex dependencies.
Specifically targets telnet-based IoT malware like Mirai by emulating vulnerable services, providing precise fingerprinting and threat intelligence from attacker IPs.
Uses JSON configuration to define expected commands and custom responses, allowing adaptation to different malware families as shown in the sample Mirai configs.
Optional forwarding of fingerprinted IPs to syslog servers enables centralized monitoring, enhancing its utility in network security setups.
Requires Python 2.7, which is deprecated and unsupported, leading to security risks and compatibility issues with modern systems.
Known issues with the telnetsrv library cause AttributeErrors, requiring manual code modifications as described in the README, adding setup complexity.
Admits that some malware scanners may crash upon receiving responses, reducing effectiveness for complete attack simulation, as noted in the known issues section.
Only emulates telnet services, making it ineffective for detecting attacks on other common IoT protocols like HTTP or SSH, limiting its scope.