{"componentChunkName":"component---src-templates-category-js","path":"/categories/tools/","result":{"data":{"category":{"name":"Tools","description":"","slug":"tools"},"posts":{"edges":[{"node":{"id":"13ba7811-8420-5fbe-afba-edab7cde09f4","title":"Open Source Honeypots That Detect Threats For Free","content":"<p>If you&#8217;re a target for either financially motivated cyber criminals, or nation state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker. The principles of deception have been around for years, and recently, they&#8217;ve become the secret weapon of purple teams and threat hunters worldwide. Here&#8217;s the good new &#8212; You can start seeing the benefits of deception for free using open source honeypots that can be deployed immediately.</p>\n<p>Deception is so crucial to detecting lateral movement, uncovering privilege escalation, and building threat intelligence, that <em>any</em> deception, even open-source honeypots are valuable. Whenever we&#8217;re on the road, we make it a point to give a shout-out to some of these tools, and will happily help you plan how you can use them. And we&#8217;ll do this for free, no strings attached. Just <a href=\"/contact\">get in touch</a>!</p>\n<p><em>Caveat Emptor</em>: You get what you pay for &#8212; Some of these tools may no longer be supported, and will require leg-work to setup and see results. However, they&#8217;re a great way to get familiar with deception. They&#8217;re also emulations, not real systems, so don&#8217;t expect high-interaction activity. While we&#8217;ll offer friendly advice around how you can use them, we don&#8217;t officially support them.</p>\n<p>For more on planning effective deception, check out our strategy focused blog-posts:</p>\n<ul>\n<li><a href=\"/10-questions-to-ask-your-deception-technology-provider/\">10 Questions To Ask Your Deception Provider</a></li>\n<li><a href=\"/7-deadly-sins-how-to-fail-at-implementing-deception-technology/\">7 Deadly Sins &#8211; How to Fail at Implementing Deception</a></li>\n</ul>\n<h2>Network services honeypots</h2>\n<ul>\n<li><a href=\"https://github.com/micheloosterhof/cowrie\">Cowrie</a> &#8211; Cowrie is an SSH honeypot based off an earlier favourite called <a href=\"https://github.com/desaster/kippo\">Kippo</a>. It will emulate an interactive SSH server with customisable responses to commands. Another alternative is <a href=\"https://github.com/tnich/honssh\">HonSHH</a> which sits between a real SSH server and the attacker, MiTMing the connection and logging all SSH communications.</li>\n<li><a href=\"https://github.com/DinoTools/dionaea\">Dionaea</a> is a multi-protocol honeypot that covers everything from FTP to SIP (VoIP attacks). Where it really excels is for SMB decoys. It can even simulate malware payload execution using <a href=\"https://github.com/buffer/libemu\">LibEmu</a> to analyse multi-part stagers.</li>\n</ul>\n<h2>IOT (Internet of Things) honeypots</h2>\n<ul>\n<li><a href=\"https://github.com/omererdem/honeything\">Honeything</a> emulates the TR-069 WAN management protocol, as well as a RomPager web-server, with vulnerabilities. Other IoT decoys can be created by emulating embedded telnet / FTP servers, for example with BusyBox.</li>\n</ul>\n<h2>SCADA/ICS honeypots</h2>\n<ul>\n<li><a href=\"http://conpot.org\">ConPot</a> emulates a number of operational technology control systems infrastructure. These include protocols like MODBUS, DNP3 and BACNET. It comes with a web-server that can emulate a SCADA HMI as well.</li>\n<li><a href=\"https://github.com/sjhilt/GasPot\">GasPot</a> emulates a Veeder Root Gaurdian AST that is commonly used for monitoring in the oil and gas industry.</li>\n</ul>\n<h2>Database and NoSQL honeypots</h2>\n<ul>\n<li><a href=\"https://github.com/Plazmaz/MongoDB-HoneyProxy\">MongoDB-HoneyProxy</a> emulates an insecure MongoDB database. Hackers regularly scan the interwebs looking for administrators who had an &#8216;oops moment&#8217; and exposed their DB to the world.</li>\n<li><a href=\"https://github.com/jordan-wright/elastichoney\">ElasticHoney</a> emulates an ElasticSearch instance, and looks for attempted remote code execution.</li>\n</ul>\n<h2>Credential honeypots and honeytokens</h2>\n<ul>\n<li><a href=\"https://github.com/secureworks/dcept\">DCEPT</a> by Dell SecureWorks places deceptive credentials in Microsoft&#8217;s Active Directory.</li>\n<li><a href=\"https://github.com/thinkst/canarytokens\">Canarytokens</a> by the great guys at Thinkst let you place different types of decoy data across your systems, waiting for an attacker to trigger them.</li>\n</ul>\n<h2>Honeyclients and malware analysis</h2>\n<ul>\n<li><a href=\"https://buffer.github.io/thug/\">Thug</a> is a &#8216;honeyclient&#8217; that mimics the behaviour of a web-browser to analyse client-side exploits. It can be used to analyse dodgy links, determining whether they serve up malicious JavaScript, ActiveX or Flash components. It can download payload samples and integrates with VirusTotal to analyse what gets served.</li>\n<li><a href=\"https://cuckoosandbox.org\">Cuckoo Sandbox</a> is not really a honeypot, but it&#8217;s a great sandbox for malware analysis. You can safely and programmatically execute possible malware samples, including binaries, Microsoft Office documents and emails within a Cuckoo VM. You&#8217;ll receive a full report on what the code executed, what file / registry changes were made, and what network callbacks were observed. Pair it with <a href=\"http://vmcloak.org\">VMCloak</a> to automatically build sandbox VMs that are harder for malware to fingerprint.</li>\n</ul>\n<h2>All-in-One</h2>\n<ul>\n<li><a href=\"http://bruteforcelab.com/honeydrive\">Honeydrive</a> is a GNU/Linux distribution that comes pre-installed with a lot of active defence capabilities. Consider it the anti-Kali.</li>\n<li><a href=\"https://github.com/threatstream/mhn\">MHN</a> combines Snort, Kippo, Dionaea and Conpot, and wraps them for easy installation and use.</li>\n</ul>\n<p>Setting up most of these open source honeypots in a lab should be a fairly simple weekend project for seasoned security professionals. You can then run red-team style attacks against them to understand what sort of telemetry you can expect. Finally, you can tweak the source to reduce how easily they can be fingerprinted (don&#8217;t forget to submit patches to the authors if you do).</p>\n<p>If you&#8217;d like to take the next step with professional deception technology, check out our <a href=\"/\">IllusionBLACK</a> platform by <a href=\"/demo/\">seeing a live demo</a>.</p>\n","excerpt":"If you’re a target for either financially motivated cyber-criminals, or nation-state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker.\n","slug":"practical-honeypots-a-list-of-open-source-deception-tools-that-detect-threats-for-free","date":"2017-09-20T12:18:42.000Z","status":"publish","modified":"2020-09-14T06:17:12.000Z","wordpress_id":16927,"featured_media":{"id":"fe9a8c35-b0a3-525e-b272-29dd6f0cbf3b","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/Open-source-honeypots-Smokescreen.jpeg","alt_text":"Open source honeypots","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAdyTzAUP/8QAFhABAQEAAAAAAAAAAAAAAAAAEAEC/9oACAEBAAEFAq6f/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFBABAAAAAAAAAAAAAAAAAAAAIP/aAAgBAQAGPwJf/8QAGBAAAwEBAAAAAAAAAAAAAAAAAAERECH/2gAIAQEAAT8haFudDef/2gAMAwEAAgADAAAAEEPP/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPxA//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhAAAwADAQAAAAAAAAAAAAAAAAERECFBMf/aAAgBAQABPxCSvwlLzgno0R4Ez//Z","aspectRatio":1.5037593984962405,"src":"/static/03cd33bfc3eac071715696dc4b64baf3/14b42/Open-source-honeypots-Smokescreen.jpg","srcSet":"/static/03cd33bfc3eac071715696dc4b64baf3/f836f/Open-source-honeypots-Smokescreen.jpg 200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/2244e/Open-source-honeypots-Smokescreen.jpg 400w,\n/static/03cd33bfc3eac071715696dc4b64baf3/14b42/Open-source-honeypots-Smokescreen.jpg 800w,\n/static/03cd33bfc3eac071715696dc4b64baf3/47498/Open-source-honeypots-Smokescreen.jpg 1200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/0e329/Open-source-honeypots-Smokescreen.jpg 1600w,\n/static/03cd33bfc3eac071715696dc4b64baf3/eeda9/Open-source-honeypots-Smokescreen.jpg 1650w","srcWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/58556/Open-source-honeypots-Smokescreen.webp","srcSetWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/61e93/Open-source-honeypots-Smokescreen.webp 200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/1f5c5/Open-source-honeypots-Smokescreen.webp 400w,\n/static/03cd33bfc3eac071715696dc4b64baf3/58556/Open-source-honeypots-Smokescreen.webp 800w,\n/static/03cd33bfc3eac071715696dc4b64baf3/99238/Open-source-honeypots-Smokescreen.webp 1200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/7c22d/Open-source-honeypots-Smokescreen.webp 1600w,\n/static/03cd33bfc3eac071715696dc4b64baf3/36d36/Open-source-honeypots-Smokescreen.webp 1650w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAdyTzAUP/8QAFhABAQEAAAAAAAAAAAAAAAAAEAEC/9oACAEBAAEFAq6f/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFBABAAAAAAAAAAAAAAAAAAAAIP/aAAgBAQAGPwJf/8QAGBAAAwEBAAAAAAAAAAAAAAAAAAERECH/2gAIAQEAAT8haFudDef/2gAMAwEAAgADAAAAEEPP/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPxA//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhAAAwADAQAAAAAAAAAAAAAAAAERECFBMf/aAAgBAQABPxCSvwlLzgno0R4Ez//Z","aspectRatio":1.5066666666666666,"src":"/static/03cd33bfc3eac071715696dc4b64baf3/32fd5/Open-source-honeypots-Smokescreen.jpg","srcSet":"/static/03cd33bfc3eac071715696dc4b64baf3/06e94/Open-source-honeypots-Smokescreen.jpg 113w,\n/static/03cd33bfc3eac071715696dc4b64baf3/07ab6/Open-source-honeypots-Smokescreen.jpg 225w,\n/static/03cd33bfc3eac071715696dc4b64baf3/32fd5/Open-source-honeypots-Smokescreen.jpg 450w,\n/static/03cd33bfc3eac071715696dc4b64baf3/4a838/Open-source-honeypots-Smokescreen.jpg 675w,\n/static/03cd33bfc3eac071715696dc4b64baf3/9842e/Open-source-honeypots-Smokescreen.jpg 900w,\n/static/03cd33bfc3eac071715696dc4b64baf3/eeda9/Open-source-honeypots-Smokescreen.jpg 1650w","srcWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/b8a88/Open-source-honeypots-Smokescreen.webp","srcSetWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/3a3bf/Open-source-honeypots-Smokescreen.webp 113w,\n/static/03cd33bfc3eac071715696dc4b64baf3/975bf/Open-source-honeypots-Smokescreen.webp 225w,\n/static/03cd33bfc3eac071715696dc4b64baf3/b8a88/Open-source-honeypots-Smokescreen.webp 450w,\n/static/03cd33bfc3eac071715696dc4b64baf3/761da/Open-source-honeypots-Smokescreen.webp 675w,\n/static/03cd33bfc3eac071715696dc4b64baf3/210c1/Open-source-honeypots-Smokescreen.webp 900w,\n/static/03cd33bfc3eac071715696dc4b64baf3/36d36/Open-source-honeypots-Smokescreen.webp 1650w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}}]}},"pageContext":{"id":"c25feec8-5d9d-5e1e-874d-8be6a121936d"}},"staticQueryHashes":["1478079672"]}