Computers

A tool to analyze honeyd-logfiles of the honeyd-daemon. Generates graphical and textual results from queries against the logfile data.

A toolkit designed to make it appear to attackers as if the system running DTK has a large number of widely known vulnerabilities.

Honeypots that dynamically learn your network then deploy virtual honeypots that adapt to your network.

This paper evaluates the usefulness of using honeypots to fight Internet worms and perform counterattacks.

This paper discusses honeytokens, honeypots that are not computers, but rather digital entities that are stored in a restricted part of the network.

A hacker is lured, endured, and studied. One of the first examples of a honeypot. First published in 1992.

Article discussing issues with Honeypot technology, focusing on dealing with the possibility of your Honeypot being detected (and potentially abused) by an attacker.

This paper evaluates the usefulness of using honeypots to fight spammers.

A program that creates a tarpit or, as some have called it, a "sticky honeypot".

This article is about deploying and managing honeypots in large, distributed environments through the use of Honeypot Farms.

Article discussing the use of honeypot technology to combat attacks on wireless networks.

SCADA HoneyNet Project: Building Honeypots for Industrial Networks (SCADA, DCS, and PLC architectures).

A program that acts as a honeypot for spammers who use spambots to harvest email addresses from Web sites.

Impost can either act as a honey pot and take orders from a Perl script controlling how it responds and communicates with connecting clients; or it can operate as a packet sniffer and monitor incoming data to specified destination port supplied by the command-line arguments (pre-release version available).

A collection of programs to deploy, run and analyse network and host simulations in IP networks.

Article discussing methods hackers use to detect honeypots.

A Darknet is a portion of routed, allocated IP space in which no active services or servers seemingly reside. However, there is in fact include at least one server for real-time analysis or post-event network forensics.

Website set up to deliver almost infinite numbers of bogus email addresses to email harvesting bots.

This two-part paper discusses how hackers discover, interact with, and sometimes disable honeypots at the system level and the application layer.

A Windows honeypot designed to attract and detect hackers by simulating vulnerable system services and trojans.

Live honeynet status data, papers produced as a result of research, and other related resources.

A system that redirects all hostile traffic from your production systems to a honeypot that is a partial mirror of your production system. Once switched, the would-be hacker is unknowingly attacking your honeypot instead of the real data.

Web Application Security Consortium Distributed Open Proxy Honeypot Project.

European Network of Affiliated Honeypots.

Seller of HoneyPoint family of products.

A system for automated generation of signatures for network intrusion detection systems (NIDSs).

Emulates a vulnerable web application by allowing itself to be indexed by search engines. Project information and free download.

A series of white papers describing the concepts and technology of the Honeynet Project and Research Alliance and sharing lessons learned.

Brief encyclopedia article describing Honeypots.

Article discussing the creation of the Honeynet Project.

A simple honey pot program based on iptables redirects and an xinetd listener.

Encyclopedia article about the security devices, including several examples.

A medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.

Glastopf is a small Python webserver which emulates thousands of web application vulnerabilities.

Honeyd configuration wizard, a SQL Interface, and reports.

Sink Holes - an ISP Security Tool

A Python low-interaction honeyclient aimed at mimicing the behavior of a web browser in order to detect and emulate malicious contents

Research paper suggesting a simple method for improving the security of hashed passwords: the maintenance of additional \\honeywords" (false passwords) associated with each user's account.

Describing new scheme of password protection called honeywords.

Premiere honeypot bundle distro.

A honeypot for the Windows System with http (web), ftp, tftp, finger, pop3 enabled

Dshield web honeypot