An open-source Python framework for creating honeypots and honeynets to detect and analyze cyber attacks.
OWASP Honeypot is an open-source Python framework for creating honeypots and honeynets, which are deceptive systems designed to attract and monitor cyber attacks. It automates the deployment of services like FTP, HTTP, and SSH with weak credentials to lure attackers, allowing security teams to study their tactics and improve defenses.
Security researchers, penetration testers, and IT administrators who need to detect and analyze network intrusions in a safe, controlled environment.
Developers choose OWASP Honeypot for its modular, Docker-based architecture that simplifies setup and isolation, along with integrated logging and visualization tools for real-time attack monitoring without risking production data.
OWASP Honeypot, Automated Deception Framework.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports emulation of FTP, HTTP, and SSH with configurable weak password modules, allowing targeted attraction of attackers based on protocol vulnerabilities, as shown in the example loading modules.
Uses Docker containers to deploy honeypot services, ensuring easy setup, removal, and isolation from the host system, evident in the example output where containers are created and destroyed cleanly.
Includes a web dashboard and REST API for managing honeypots, viewing logs, and analyzing attack data in real-time, referenced in the API and WebUI section with ElasticSearch integration.
Creates separate internal and external networks to control traffic flow and enhance security during monitoring, as demonstrated in the network creation steps during deployment.
The project is explicitly in a research and development phase, with warnings about errors and no warranty in the README, making it unreliable for production or critical use.
Only supports FTP, HTTP, and SSH emulation, which may not capture attacks targeting other common services like SMTP or DNS, limiting its comprehensiveness for threat detection.
Requires Docker, ElasticSearch, and Python dependencies for full functionality, adding setup complexity and potential points of failure, especially for users unfamiliar with these technologies.