{"id":49909318,"url":"https://github.com/morgenm/basicgopot","last_synced_at":"2026-05-16T11:38:05.523Z","repository":{"id":174530819,"uuid":"652340321","full_name":"morgenm/basicgopot","owner":"morgenm","description":"Honeypot for file uploads. Written in Go.","archived":false,"fork":false,"pushed_at":"2025-12-20T10:43:19.000Z","size":91414,"stargazers_count":16,"open_issues_count":44,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-12-22T15:51:27.543Z","etag":null,"topics":["cybersecurity","deception","defense","detection","golang","honeypot","http","malware-analysis","network-security","security"],"latest_commit_sha":null,"homepage":"https://morgenm.github.io/blog/2023/basicgopot-hybrid-analysis/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/morgenm.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-06-11T20:48:29.000Z","updated_at":"2024-09-04T09:23:48.000Z","dependencies_parsed_at":"2024-05-15T16:14:38.087Z","dependency_job_id":"72c91c14-f5fb-4ee7-b6b0-9aebe19d8505","html_url":"https://github.com/morgenm/basicgopot","commit_stats":null,"previous_names":["morgenm/basicgopot"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/morgenm/basicgopot","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morgenm%2Fbasicgopot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morgenm%2Fbasicgopot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morgenm%2Fbasicgopot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morgenm%2Fbasicgopot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/morgenm","download_url":"https://codeload.github.com/morgenm/basicgopot/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/morgenm%2Fbasicgopot/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33101173,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-16T04:41:52.686Z","status":"ssl_error","status_checked_at":"2026-05-16T04:41:52.009Z","response_time":115,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cybersecurity","deception","defense","detection","golang","honeypot","http","malware-analysis","network-security","security"],"created_at":"2026-05-16T11:38:04.809Z","updated_at":"2026-05-16T11:38:05.518Z","avatar_url":"https://github.com/morgenm.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# BasicGoPot\n\n**_A highly configurable and customizable honeypot server written in Go._**\n\n[![Go](https://github.com/morgenm/basicgopot/actions/workflows/go.yml/badge.svg)](https://github.com/morgenm/basicgopot/actions/workflows/go.yml)\n[![golangci](https://github.com/morgenm/basicgopot/actions/workflows/golangci-lint.yml/badge.svg)](https://github.com/morgenm/basicgopot/actions/workflows/golangci-lint.yml)\n[![Gosec](https://github.com/morgenm/basicgopot/actions/workflows/gosec.yml/badge.svg)](https://github.com/morgenm/basicgopot/actions/workflows/gosec.yml)\n[![Go Report Card](https://goreportcard.com/badge/github.com/morgenm/basicgopot)](https://goreportcard.com/report/github.com/morgenm/basicgopot)\n[![Docs](https://pkg.go.dev/badge/github.com/morgenm/basicgopot)](https://pkg.go.dev/github.com/morgenm/basicgopot)\n[![GitHub Downloads](https://img.shields.io/github/downloads/morgenm/basicgopot/total)](https://github.com/morgenm/basicgopot/releases)\n[![Docker Pulls](https://img.shields.io/docker/pulls/morgenm/basicgopot)](https://hub.docker.com/r/morgenm/basicgopot/)\n[![codecov](https://codecov.io/gh/morgenm/basicgopot/branch/main/graph/badge.svg?token=R2LE7BBNJQ)](https://codecov.io/gh/morgenm/basicgopot)\n\n## About\nCustomizable HTTP honeypot which saves and logs all files uploaded to it. It can check file hashes against VirusTotal, upload files to VirusTotal, and save VirusTotal scan results. Configurable WebHooks let you easily customize what the server does once a file is uploaded. You can use any **HTML** and **CSS** to make the server look how you want it.\n\n## Install\n\nYou can grab the latest release for this project from GitHub and just run the executable after [creating the config file](#configuration). Other options are listed below.\n\n### Install with *go install*\n\n```bash\ngo install github.com/morgenm/basicgopot/cmd/basicgopot@latest\n```\n\n### Docker-compose\nTo run with docker-compose, copy the compose file located in `build/docker-compose.yml`.\n\nYou can either set the location to the basicgopot files with:\n```bash\nexport BASICGOPOT_LOC=/path/to/basicgopot\n```\nor edit the values in `build/docker-compose.yml`.\n\nYou will need to copy the example config to wherever you specify your `config` directory to be located and rename the file to `config.json`. By default, all logs will be saved to what you specify as the `logs` directory and uploads will be in `uploads`.\n\nRun the following command to start the server:\n```bash\ndocker compose up -d\n```\n\n### Docker image\n\nGet the docker image by running:\n```bash\ndocker pull morgenm/basicgopot:latest\n```\n\nTo run the docker image:\n```bash\ndocker run -p 8080:8080 -v $(pwd)/config:/config -v $(pwd)/uploads:/uploads:rw -v $(pwd)/logs:/logs morgenm/basicgopot:latest\n```\nThe `echo` command must be run the first time the server is run because `uploads.json` must exist for it to not be mapped as a directory by docker.\n\n### Building docker image\n\nAfter downloading the source, run:\n```bash\nmake docker\n```\nThe docker image will be tagged as `basicgopot`.\n\n### Building Locally\n\nIf you wish to build, you can: \n```bash\ngit clone https://github.com/morgenm/basicgopot\nmake\n```\nThis will output the executable file `basicgopot` on Linux or Mac, and `basicgopot.exe` on Windows\n\n## Configuration\nThe configuration for **_basicgopot_** is stored in `config/config.json`. An example config file is provided in `config/config.json.example`. You will need to rename `config/config.json.example` to `config/config.json` and fill in the configuration variables as you see fit. The configuration options are:\n```json\n{\n    \"ServerPort\" : 8080, // The port the server runs on\n    \"LogFile\" : \"logs/log.log\", // What file to save server logs to.\n    \"UploadLimitMB\" : 512, // Size limit in Megabytes for a single file upload to the server\n    \"UseVirusTotal\" : true, // Whether to use VirusTotal \n    \"UploadVirusTotal\" : true, // Whether to upload the sample to VirusTotal if it's unique\n    \"VirusTotalApiKey\" : \"lol\", // VirusTotal user API key (needed if UseVirusTotal is true)\n    \"ScanOutputDir\" : \"logs/scans/\", // Directory to store downloaded VirusTotal scans in \n    \"UploadsDir\" : \"uploads/\", // Directory to store files uploaded to the server\n    \"UploadLog\" : \"logs/uploads.json\", // File for logging upload and scan/analysis information\n    \"WebHookDir\" : \"logs/webhooks/\", // Directory to save WebHook responses\n    \"UploadWebHooks\" : { // WebHook definitions. Set to {} for no WebHooks.\n        \"Flask\" : { // Unique WebHook Name\n            \"URL\" : \"http://localhost:5000\",\n            \"Method\" : \"POST\", // Only POST is supported right now.\n            \"Headers\" : { // Custom headers\n                \"api-key\": \"api-key\",\n                \"user-agent\": \"basicgopot\",\n                \"accept\": \"*/*\"\n            },\n            \"Forms\" : { // Form field values\n                \"test\" : \"test field\", // Any string is acceptable.\n                \"file\" : \"$FILE\" // $FILE will be replaced with the file data and will turn this into a file field.\n            }\n        }  \n    }\n}\n```\n\nIf `UploadVirusTotal` is false, but `UseVirusTotal` is true, the uploaded samples' hashes will be checked against VirusTotal, but they will not be uploaded. Note: `UseVirusTotal` has precedence over `UploadVirusTotal`, so if `UseVirusTotal` is false and `UploadVirusTotal` is true, `UploadVirusTotal` will be ignored. \n`ScanOutputDir`, `UploadsDir`, `UploadLog`, and `WebHookDir` can all be left empty (`\"\"`) if you don't want to save scans, save the uploaded files, log them to the upload log file, or save WebHook responses, respectively.\n\nUploadWebHooks are WebHooks that will execute every time a file is uploaded to the server. You can use this to send the file to other servers, such as sending the file to a **Cuckoo** server to queue it for analysis. Right now, only `POST` requests are supported. The `Forms` variable defines what data is sent to the given URL as a form, where the key is the field name and the value is the field value. These can be any strings, and any instance of `$FILE` in the string will be replaced with the entire data of the uploaded file. All WebHooks must have a unique name; the WebHook in this example is titled `Flask`. If you don't want to use any WebHooks, you can set `\"UploadWebHooks\" : {}`.\n\n\n## VirusTotal\n**_basicgopot_** can be configured to either check the hashes of uploaded files against **VirusTotal**, upload the files to **VirusTotal**, or both. The results of the scans can be saved to a chosen directory.\n\n![Sample log output](https://github.com/morgenm/basicgopot/blob/assets/docs/log.png?raw=true \"Sample log output\")\n\nA sample JSON output is listed below. I uploaded Win32.Zeus to the server. This sample is already present on VirusTotal, so the scan results were saved.\n\n![Win32.Zeus output](https://github.com/morgenm/basicgopot/blob/assets/docs/win32_zeus.png?raw=true \"Win32.Zeus output\")\n\n## Templates\n### Default template\nThe screenshot below displays the default template. It is a basic file upload form disguised as a firmware update upload. This template is named `firmware_update_v2`.\n\n![Template Firmware Upload v2](https://github.com/morgenm/basicgopot/blob/assets/docs/template_firmware_upload_v2.png?raw=true \"Default template\")\n\n### Resume upload\nAnother template provided is a simple job posting, where you write some basic info and upload a resume. This template is `resume_upload`.\n\n![Template Resume](https://github.com/morgenm/basicgopot/blob/assets/docs/template_resume.png?raw=true \"Resume template\")\n\n### Blog post upload\nA more complete template is `blog_upload`. The \"blog\" is hosted at `/` and it has a \"hidden\" admin page for uploading posts at `/admin.html`. The admin file is listed as disallow in `robots.txt`. The blog posts are under `/posts/`. \n\n![Template Blog](https://github.com/morgenm/basicgopot/blob/assets/docs/template_blog_index.png?raw=true \"Blog template\")\n\n![Template Blog Post](https://github.com/morgenm/basicgopot/blob/assets/docs/template_blog_post.png?raw=true \"Blog post\")\n\n![Template Blog Upload](https://github.com/morgenm/basicgopot/blob/assets/docs/template_blog_upload.png?raw=true \"Blog admin upload\")\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmorgenm%2Fbasicgopot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmorgenm%2Fbasicgopot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmorgenm%2Fbasicgopot/lists"}