https://github.com/Shmakov/Honeypot

Low interaction honeypot that displays real time attacks
https://github.com/Shmakov/Honeypot

data-visualization honeypot logs nodejs security ssh tail telnet

Last synced: about 2 months ago
JSON representation

Low interaction honeypot that displays real time attacks

• Host: GitHub
• URL: https://github.com/Shmakov/Honeypot
• Owner: Shmakov
• Archived: true
• Created: 2018-05-14T19:43:14.000Z (over 6 years ago)
• Default Branch: master
• Last Pushed: 2020-08-17T21:34:47.000Z (about 4 years ago)
• Last Synced: 2024-08-01T09:26:32.415Z (about 2 months ago)
• Topics: data-visualization, honeypot, logs, nodejs, security, ssh, tail, telnet
• Language: JavaScript
• Homepage: https://tail-f.shmakov.net/
• Size: 3.34 MB
• Stars: 373
• Watchers: 8
• Forks: 29
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# Overview

Low interaction honeypot application that displays real time attacks in the web-interface. Made just for fun and it is not production ready.

Written in Node.js the application listens on 128 most common TCP ports and saves results to the MySQL Database for further analysis. 

## Demo

Web-interface demo available at https://tail-f.shmakov.net/



## How to Deploy

We need nodejs, git and tcpdump

```

sudo yum install git nodejs tcpdump -y

```

Clone the repo, install dependencies and run the app.js. Please make sure that none of your own services are listening on the ports 21, 22, 80 and [~128 more ports](lib/tcp-ports.js).

```

git clone https://github.com/Shmakov/Honeypot.git

cd Honeypot/ && npm install

sudo node app.js # Please think twice before running random person's code with the sudo privileges

```

That is it. You should be able to access the app on the port 80 from your web-browser. 

## Monthly Statistics

Stats for the past 30 days are available at https://tail-f.shmakov.net/stats

Below example is custom-made and displays the data for the month of June 2018:

- There were total of 69 074 requests to the server;

- IP Geolocation based on 11 918 unique IP Addresses;

- IP Geolocation Map is made with the help of Google Maps API and Google Fusion Tables.