https://github.com/Masood-M/yalih

YALIH (Yet Another Low Interaction Honeyclient) is a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques
https://github.com/Masood-M/yalih

Last synced: 2 months ago
JSON representation

YALIH (Yet Another Low Interaction Honeyclient) is a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques

• Host: GitHub
• URL: https://github.com/Masood-M/yalih
• Owner: Masood-M
• License: apache-2.0
• Created: 2014-02-17T02:50:42.000Z (over 10 years ago)
• Default Branch: master
• Last Pushed: 2019-06-18T23:24:10.000Z (almost 5 years ago)
• Last Synced: 2024-01-03T04:02:15.633Z (6 months ago)
• Language: Python
• Size: 7.24 MB
• Stars: 65
• Watchers: 10
• Forks: 10
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Lists

• awesome-honeypots - YALIH (Yet Another Low Interaction Honeyclient) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques. (Honeypots)
• paralax-awesome-honeypots - YALIH (Yet Another Low Interaction Honeyclient) - a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques (<a name="honeypots"></a> Honeypots)
• awesome-honeypots - YALIH (Yet Another Low Interaction Honeyclient) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques. (Honeypots)
• awesome-honeypots - YALIH (Yet Another Low Interaction Honeyclient) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques. (Honeypots)
• -awesome-honeypots- - YALIH (Yet Another Low Interaction Honeyclient) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques. (Honeypots)
• awesome-honeypots - YALIH (Yet Another Low Interaction Honeyclient) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques. (Honeypots)
• fucking-awesome-honeypots - YALIH (Yet Another Low Interaction Honeyclient) - Low-interaction client honeypot designed to detect malicious websites through signature, anomaly, and pattern matching techniques. (Honeypots)

README

        
YALIH

==================================

YALIH (Yet Another Low Interaction Honeyclient) is a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques. YALIH has the following capabilities:

*Suspecious URL collection from malicious website databases (three databases)

*URL collection through Bing API

*Suspecious URL collection from your inbox and SPAM folder through pop3 and IMAP protocol

*Javascript extraction, de-obfuscation and de-minification of scripts embedded within a website

*Referrer Emulation and redirection handling

*Cookies and session handling

*Browser and browser agent and OS emulation

*Proxy capabilities to detect Geo-location and/or IP cloacking attacks

*Signature detection using ClamAV antivirus database

*Anomaly and pattern matching detection through Yara (http://plusvic.github.io/yara/)

*Automated Yara signature generation

====================================

Easy Installation and documentation

====================================

Authors/Contributors:

========= Victoria University of Wellington ============

Masood Mansoori - [email protected]

============ Singapore Polytechnic ===============

Lai Qi Wei - [email protected]

Ritchie Lam Qiaowei - [email protected]