{"id":13957440,"url":"https://github.com/0xBallpoint/trapster-community","last_synced_at":"2025-07-20T23:30:44.493Z","repository":{"id":239569567,"uuid":"799870612","full_name":"0xBallpoint/trapster-community","owner":"0xBallpoint","description":"Multi-services Asynchronous Honeypot Solution with real-time threat detection","archived":false,"fork":false,"pushed_at":"2024-07-31T13:50:21.000Z","size":233,"stargazers_count":15,"open_issues_count":0,"forks_count":4,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-08-01T14:11:26.066Z","etag":null,"topics":["cybersecurity","honeypot","python"],"latest_commit_sha":null,"homepage":"https://trapster.cloud/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xBallpoint.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-13T09:04:30.000Z","updated_at":"2024-08-01T14:11:26.067Z","dependencies_parsed_at":"2024-06-29T09:37:12.419Z","dependency_job_id":"5a821c54-ba87-4fa9-86ce-01f14e2be6e5","html_url":"https://github.com/0xBallpoint/trapster-community","commit_stats":null,"previous_names":["0xballpoint/trapster-community"],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xBallpoint%2Ftrapster-community","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xBallpoint%2Ftrapster-community/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xBallpoint%2Ftrapster-community/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xBallpoint%2Ftrapster-community/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xBallpoint","download_url":"https://codeload.github.com/0xBallpoint/trapster-community/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":214509138,"owners_count":15743682,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cybersecurity","honeypot","python"],"created_at":"2024-08-08T13:00:42.492Z","updated_at":"2025-07-20T23:30:44.479Z","avatar_url":"https://github.com/0xBallpoint.png","language":"Python","funding_links":[],"categories":["Honeypots"],"sub_categories":[],"readme":"\u003cp align=\"right\"\u003e\n  \u003ca href=\"https://trapster.cloud\"\u003e\n    \u003cimg src=\"https://github.com/user-attachments/assets/8b658484-c2ea-4c52-86b5-fe346dc37622\" width=\"25%\" alt=\"Trapster logo\" /\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n\n\n\u003ch2 align=\"center\" \u003eTrapster Community \u003c/h2\u003e\n\u003cp align=\"center\"\u003e\u003ca href=\"https://trapster.cloud/\"\u003e🌐 Website\u003c/a\u003e · \u003ca href=\"https://docs.trapster.cloud/\"\u003e📚 Documentation\u003c/a\u003e · \u003ca href=\"https://discord.gg/nNJv8Hj5EE\"\u003e💬 Discord\u003c/a\u003e\u003c/p\u003e\n\u003cbr /\u003e\n\nTrapster Community is a low-interaction honeypot designed to be deployed on internal networks or to capture credentials. It is built to monitor and detect suspicious activities, providing a deceptive layer to network security.\n\nVisit the [Trapster website](https://trapster.cloud) to learn more about our commercial version, which includes advanced features like pre-configured hardened OS, automatic deployment, webhook, SIEM integration and much more...\n\n## Features\n\n- **Deceptive Security**: Mimics network services to lure and detect potential intruders.\n- **Asynchronous Framework**: Utilizes Python's `asyncio` for efficient, non-blocking operations.\n- **Configuration Management**: Easily configurable through `trapster.conf`.\n- **Expandable Services**: Add and configure as many services as needed with minimal effort.\n- **HTTP Honeypot Engine with AI capabilities**: Clone any website using YAML configuration, and use AI to generate responses to some HTTP requests.\n\n## Supported Protocols\n\n| Protocol | Notes |\n|----------|-------------|\n| FTP (21) | Capture FTP login attempts |\n| SSH (22) | Capture SSH login attempts |\n| Telnet (23) | Capture TELNET login attempts |\n| DNS (53) | Works as a proxy to a real DNS server, and log queries |\n| HTTP/HTTPS (80/443) | Copy website, features custom YAML configuration templating engine |\n| SNMP (161) | Log SNMP queries |\n| LDAP (389) | Capture LDAP login attempts and queries |\n| Rsync (873) | Capture RSYNC login attempts |\n| MSSQL (1433) | Capture MSSQL login attempts |\n| MySQL (3306) | Capture MySQL login attempts |\n| RDP (3389) | Capture RDP login attempts |\n| PostgreSQL (5432) | Capture POSTGRES login attempts |\n| VNC (5900) | Capture VNC login attempts |\n\n## Documentation and installation guide\n\nhttps://docs.trapster.cloud/community/\n\n## Logs\n\n### Format\nEach module can generate up to 4 types of logs: `connection`, `data`, `login`, and `query`.\n* `connection`: Indicates that a connection has been made to the module.\n* `data`: Represents raw data that has been sent, logged in HEX format. This data is unprocessed.\n* `login`: Captures login attempts to the module. The data field is in JSON format and contains processed information.\n* `query`: Logs data that has been processed and does not correspond to an authentication attempt. The data field is in JSON format and contains processed information.\n\nYou can then filter log type you don't need.\n\n## HTTP Engine with AI capabilities\n\n### Configuration\nThe HTTP module can emulate any website. It works with YAML configuration files to match requests using regular expressions, and can generate responses using either a template or an AI model.\n\nThe configuration are stored in [trapster/data/http](trapster/data/http), each folder represent a website.\nAn example of the functionnalities can be found at [trapster/data/http/demo_api/config.yaml](trapster/data/http/demo_api/config.yaml)\n\n**Structure:**\n- config.yaml: contains the configuration for the website.\n- files/: contains the static files for the website.\n- templates/: contains the templates for the website, it supports [jinja2](https://jinja.palletsprojects.com/en/3.1.x/) syntax.\n\nDocumentation : https://docs.trapster.cloud/community/modules/web/\n\n### Example: Fortigate\n\nThe default HTTPS server shows a fortigate login page:\n![image](https://github.com/user-attachments/assets/5b351089-c7b9-471b-ac33-fcc79454e73c)\n\nIf someone tries to login, you will get a log like this one:\n```json\n{\n   \"device\":\"trapster-1\",\n   \"logtype\":\"https.login\",\n   \"dst_ip\":\"127.0.0.1\",\n   \"dst_port\":8443,\n   \"src_ip\":\"127.0.0.1\",\n   \"src_port\":45182,\n   \"timestamp\":\"2025-02-28 18:53:18.498008\",\n   \"data\":\"616a61783d3126757365726e616d653d61646d696e267365637265746b65793d61646d696e2672656469723d253246\",\n   \"extra\":{\n      \"method\":\"POST\",\n      \"target\":\"/logincheck\",\n      \"headers\":{\n         \"host\":\"127.0.0.1:8443\",\n         \"connection\":\"keep-alive\",\n         \"content-length\":\"47\",\n         \"cache-control\":\"no-store, no-cache, must-revalidate\",\n         \"sec-ch-ua-platform\":\"\\\"Linux\\\"\",\n         \"pragma\":\"no-cache\",\n         \"sec-ch-ua\":\"\\\"Not(A:Brand\\\";v=\\\"99\\\", \\\"Google Chrome\\\";v=\\\"133\\\", \\\"Chromium\\\";v=\\\"133\\\"\",\n         \"sec-ch-ua-mobile\":\"?0\",\n         \"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.3\",\n         \"if-modified-since\":\"Sat, 1 Jan 2000 00:00:00 GMT\",\n         \"content-type\":\"text/plain;charset=UTF-8\",\n         \"accept\":\"*/*\",\n         \"origin\":\"https://127.0.0.1:8443\",\n         \"sec-fetch-site\":\"same-origin\",\n         \"sec-fetch-mode\":\"cors\",\n         \"sec-fetch-dest\":\"empty\",\n         \"referer\":\"https://127.0.0.1:8443/login?redir=%2F\",\n         \"accept-encoding\":\"gzip, deflate, br, zstd\",\n         \"accept-language\":\"en-US,en;q=0.9\"\n      },\n      \"status_code\":200,\n      \"username\":\"admin\",\n      \"password\":\"admin\"\n   }\n}\n```\n\n### AI ALPHA support\nTo generate responses, you can use the `ai` field in the configuration. For now, it uses [OVHCloud AI Endpoints](https://endpoints.ai.cloud.ovh.net/) as it is still free, and in beta.\nThe file `trapster/modules/libs/ai.py` contains the code to generate responses using the AI model. It is still very basic, and will be improved in the near future.\n\nFor example, this image show a request to capture SQLi attempts, and the response generated by the AI model.\n\n\u003cimg src=\"images/sqli_ai_response_1.png\" width=\"60%\"\u003e\n\n## Contributing\n\nContributions are welcome! Please follow these steps:\n\n1. Fork the repository.\n2. Create a new branch (git checkout -b feature-branch).\n3. Make your changes.\n4. Commit your changes (git commit -m 'Add new feature').\n5. Push to the branch (git push origin feature-branch).\n6. Create a pull request.\n\n## License\n\nTrapster is licensed under the GNU Affero General Public License v3 or later (AGPLv3+). See the LICENSE file for more details.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xBallpoint%2Ftrapster-community","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xBallpoint%2Ftrapster-community","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xBallpoint%2Ftrapster-community/lists"}