https://github.com/mrheinen/lophiid

A distributed honeypot for monitoring large scale web attacks
https://github.com/mrheinen/lophiid

grpc-go honeypot intrusion-detection security threat-detection threat-hunting threat-intelligence

Last synced: about 1 year ago
JSON representation

A distributed honeypot for monitoring large scale web attacks

• Host: GitHub
• URL: https://github.com/mrheinen/lophiid
• Owner: mrheinen
• License: gpl-2.0
• Created: 2023-11-09T20:08:25.000Z (over 2 years ago)
• Default Branch: main
• Last Pushed: 2024-10-29T19:35:08.000Z (over 1 year ago)
• Last Synced: 2024-10-29T21:27:14.698Z (over 1 year ago)
• Topics: grpc-go, honeypot, intrusion-detection, security, threat-detection, threat-hunting, threat-intelligence
• Language: Go
• Homepage:
• Size: 49.3 MB
• Stars: 6
• Watchers: 1
• Forks: 1
• Open Issues: 11
• Metadata Files:
  • Readme: README.md
  • Contributing: CONTRIBUTING.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# lophiid



  



![Lophiid build workflow](https://github.com/mrheinen/lophiid/actions/workflows/go.yml/badge.svg)

## Introduction

Lophiid is a distributed honeypot for detecting and interacting with mass web

application exploitation attempts.

The design of lophiid is that one backend controls multiple honeypot sensors

agents across the web. Each honeypot can be configured individually but the

backend is able to track interactions with attackers across all of them.

Say an attacker scans for / across the internet and it hits 50 lophiid

honeypots. The backend can make sure that during each individual interaction

with a honeypot a different response is send to the attacker and with that

increases the chance that the attacker gets something they are looking for which

can result in further interaction.

Similarly lophiid can respond differently to multiple command injections against

the same endpoint.

Key features:

- A distributed honeypot approach

- Rule based interactions with attacks

- Static, scripted (Javascript) and AI supported response handling

- Alerting possible (Telegram, extensible)

- UI with comprehensive search

- AI analysis of attacks

- Automatic tagging of requests and attacks to help triage

- Automatically malware collection and storage

- Yara (yara-x) integration

- Direct integration with VirusTotal

- Ratelimiting / DoS protection

- Exporting of rules for sharing with the community

- Extensive metrics for prometheus/grafana

- Highly customizable

Running lophiid is already very interesting and you'll collect a lot of threat

information. The project is still in an early phase of development though and

large changes are still to be expected in the near future.

For more information check out the [Detailed Description](./DETAILED_DESCRIPTION.md) document and get started with the

[Setup](./SETUP.md) guide.

Don't hesitate to reach out to niels.heinen{at}gmail.com for any assistance.

# Screenshots

Requests page overview which shows all the requests that honeypots are getting.

![Requests overview](./images/screenshot-requests-wget.png)

The downloads page shows information about all the downloaded payloads which

were obtained via attacks. The payloads themselves are also stored locally in

the malware directory (configurable via the backend config).

![Downloads page](./images/screenshot-payloads.png)

# Contributing

Contributions are super welcome! Just fork the repo and send us a PR. Please

regularly check the [CONTRIBUTING.md](./CONTRIBUTING.md) for general guidelines

# Documentation

* [Setup guide](./SETUP.md)

* [Detailed Description](./DETAILED_DESCRIPTION.md)

* [Screenshots](./SCREENSHOTS.md)

* [Scripted responses](./SCRIPTING.md)

* [API cli client usage](./API_CLIENT.md)

* [UI search - overview](./SEARCH.md)

* [UI search - all keywords](./SEARCH_KEYWORDS.md)

* [Payload fetching](./PAYLOAD_FETCHING.md)