A low-interaction honeypot that mimics network services and clones websites with AI-powered responses to detect intruders.
Trapster Community is an open-source, low-interaction honeypot designed to mimic real network services and websites to detect and log intrusion attempts. It captures credentials and suspicious activities across multiple protocols like SSH, HTTP, RDP, and databases, providing a deceptive security layer for internal networks. The project includes AI-powered features to generate realistic responses, making the honeypot more convincing to attackers.
Security engineers, network administrators, and red/blue teams looking to deploy deceptive security measures within their infrastructure to monitor for unauthorized access attempts.
Developers choose Trapster for its extensive protocol support, realistic website cloning capabilities, and AI integration, which together create a highly adaptable and convincing honeypot. Its modular, configuration-driven design allows for quick deployment and customization without deep coding knowledge.
Modern honeypot supporting multiple services, realistic website cloning, and AI-powered features
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports over 13 protocols including SSH, HTTP, FTP, and databases, capturing login attempts and queries across a wide range of services, as listed in the README's protocol table.
Uses AI models to generate dynamic, context-aware responses for SSH and unknown HTTP requests, making honeypot interactions more convincing and adaptable, with configurable prompts and memory sessions.
Allows cloning of any website using YAML configuration and Jinja2 templating, enabling realistic HTTP/HTTPS deception without deep coding, as demonstrated in the FortiGate example.
Produces detailed JSON logs for connections, data, logins, and queries, facilitating easy analysis and integration with security tools, with logs filterable by type.
As a low-interaction honeypot, it doesn't provide full interactive environments, which may miss deeper attacker techniques like command execution or lateral movement beyond initial access.
AI features require external API keys (e.g., OpenAI), adding ongoing costs and setup complexity, and introduce dependency on third-party services that may affect reliability.
Setting up realistic deceptions, especially with custom website cloning and AI prompts, involves detailed YAML files and environment variables, which can be time-consuming for beginners.