{"id":13530178,"url":"https://github.com/christophe77/express-honeypot","last_synced_at":"2025-05-12T21:46:05.476Z","repository":{"id":113536534,"uuid":"446280358","full_name":"christophe77/express-honeypot","owner":"christophe77","description":"Express honeypot for remote file inclusion (RFI) and local file inclusion (LFI).","archived":false,"fork":false,"pushed_at":"2025-02-26T16:21:55.000Z","size":1120,"stargazers_count":19,"open_issues_count":0,"forks_count":8,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-05-10T09:51:10.612Z","etag":null,"topics":["exploit","express","honeypot","lfi","nodejs","rfi"],"latest_commit_sha":null,"homepage":"https://github.com/christophe77/express-honeypot","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/christophe77.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-01-10T04:30:24.000Z","updated_at":"2025-04-25T11:53:45.000Z","dependencies_parsed_at":null,"dependency_job_id":"8b447a7d-3a0e-494c-afbb-209e99c9bb8a","html_url":"https://github.com/christophe77/express-honeypot","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/christophe77%2Fexpress-honeypot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/christophe77%2Fexpress-honeypot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/christophe77%2Fexpress-honeypot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/christophe77%2Fexpress-honeypot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/christophe77","download_url":"https://codeload.github.com/christophe77/express-honeypot/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253829792,"owners_count":21970986,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["exploit","express","honeypot","lfi","nodejs","rfi"],"created_at":"2024-08-01T07:00:45.186Z","updated_at":"2025-05-12T21:46:05.455Z","avatar_url":"https://github.com/christophe77.png","language":"JavaScript","funding_links":[],"categories":["Honeypots","Recently Updated"],"sub_categories":["[Apr 02, 2025](/content/2025/04/02/README.md)"],"readme":"# express-honeypot\n\nExpress honeypot is a honeypot for remote file inclusion (RFI) and local file inclusion (LFI).\u003cbr /\u003e\nThe aim of this project is to catch bots and malwares that are scanning websites and try to upload remote files.\u003cbr /\u003e\nThose RFI / LFI bots use a list of google dorks in order to search the web for vulnerable website.\u003cbr /\u003e\nExpress honeypot uses 310 fake urls based on RFI LFI dorks and serves them dynamicaly.\u003cbr /\u003e\nEvery request to any of the honeypot urls is logged and the remote file is downloaded and safely stored.\u003cbr /\u003e\nThis honeypot is written in javascript and uses express as web server.\u003cbr /\u003e\nA light logs viewer page is available at /beekeeper but I think it needs to have more commands.\u003cbr /\u003e\nDevelopement is still in progress but the core architecture won't change so you are safe to start using it.\u003cbr /\u003e\n\n## How to use\n\nClone the project and install the dependencies :\u003cbr /\u003e\n\n    git clone https://github.com/christophe77/express-honeypot\n    cd express-honeypot\n    yarn install\n\nEdit _/express/config.js_ file.\u003cbr /\u003e\n_port_ is the port for the web server.\u003cbr /\u003e\n_beekeeperCredentials_ username and password to access /beekeeper url.\u003cbr /\u003e\n_remoteFileSave_ choose to save the remote file on your local drive, on dpaste or on both of them.\u003cbr /\u003e\n_googleVerification_ is the key given in google search console to validate your website.\u003cbr /\u003e\n\nOnce installed you can start the app with :\u003cbr /\u003e\n\n    yarn start\n\n## How it works when deployed\n\nThe app starts a web server, generate a sitemap with known vulnerables paths from phpBB, joomla,....\u003cbr /\u003e\nWhen a visitor opens an url and tries to include a remote file, the informations about the request are stored inside a json file in the _/express/hive_ directory.\u003cbr /\u003e\nThe remote file used for the inclusion is downloaded inside the hive folder with a .bee extension _/express/hive/files/YYYY-MM-DD/filename.ext.bee_\u003cbr /\u003e\nWhen an url is opened, a fake page is display with some basic html tags, random text and some SEO for google bots.\u003cbr /\u003e\nIf the page is opened with a remote file inside the url then the content of the file is added to the response body as if the injection worked.\u003cbr /\u003e It's displayed in text and no real injection is posible.\u003cbr /\u003e\nIf you want your honeypot to be effective you need to spread it over search engines.\u003cbr /\u003e Google search console is the best option to start.\u003cbr /\u003e\nWhen you want to check the logs you have to go to _your-website.com/beekeeper_\u003cbr /\u003e\n\n## How to add more fake urls\n\nIf you want to add urls you have to open _/express/pages.js_ and add new datas.\u003cbr /\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchristophe77%2Fexpress-honeypot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchristophe77%2Fexpress-honeypot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchristophe77%2Fexpress-honeypot/lists"}