Low Interaction Honeypot: HoneyPy

2016-11-03T01:17:06
ID N0WHERE:131154
Type n0where
Reporter N0where
Modified 2016-11-03T01:17:06

Description

A low interaction honeypot with the capability to be more of a medium interaction honeypot. HoneyPy is written in Python and is intended to be easy to: deploy, extend functionality with plugins, and apply custom configurations. The level of interaction is determined by the functionality of a plugin. Plugins can be created to emulate UDP or TCP based services to provide more interaction. All activity is logged to a file by default, but posting honeypot activity to Twitter or a web service endpoint can be configured as well.

You should not run HoneyPy as root! It is recommended to use a dedicated account to run under. HoneyPy is developed and run on Debian. There’s no reason why it should not work on other Linux/Unix flavors as long as all Python dependencies are installed.

Console Mode

Run in console mode: python Honey.py

In console mode services do not automatically start, use the start command. Type the help command for a list of command options. Example of the console screen:

                                ___       
  /\  /\___  _ __   ___ _   _  / _ \_   _ 
 / /_/ / _ \| '_ \ / _ \ | | |/ /_)/ | | |
/ __  / (_) | | | |  __/ |_| / ___/| |_| |
\/ /_/ \___/|_| |_|\___|\__, \/     \__, |
                        |___/       |___/


[HoneyPy v0.1.0 Copyright (c) 2013-2016. foospidy]

HoneyPy Console. For help type 'help'.
HoneyPy>start
8 service(s) started!
HoneyPy>

Deamon Mode

In deamon mode all configured services will automatically start and listen for connections.

Run in deamon mode: python Honey.py -d &

Low Interaction Honeypot: HoneyPy documentation

Custom Service Emulation (Plugins)

HoneyPy uses the concept of plugins for custom service emulators. Plugins can make the honeypot look more like a real system in order to invoke more interaction and capture more attack data. Plugins are simply a Python module that is loaded when HoneyPy is started. HoneyPy leverages the Twisted library to handle connections. There are example service emulators included in the plugins directory. These will be improved, and more added, in the future. Example:

[Echo]
plugin      = Echo
low_port    = tcp:7
port        = tcp:10007
description = Echo back data received via tcp.
enabled     = Yes

Dependencies

You can now use the requirements.txt file to install all dependicies. Use the following command:

pip install -r requirements.txt

If the command above does not work you can try installing the individual dependencies listed below.

Requests

To install on Debian:

apt-get install python-requests

or

pip install requests

Twisted

HoneyPy is completely dependent on the Twisted. Learn more about Twisted here https://twistedmatrix.com .

To install on Debian:

apt-get install python-twisted

Low Interaction Honeypot: HoneyPy Download