Glastopf

HoneyDrive is the premier honeypot Linux distro with over 10 pre-installed honeypot software packages and numerous analysis tools.

Glastopf is a Python web application honeypot created by Lukas Rist. Its general approach focuses on emulating vulnerability types rather than specific vulnerabilities. Once a vulnerability type is emulated, Glastopf can manage unknown attacks that belong to the same category. Although the implementation may be slower and more complex, this strategy allows us to stay ahead of attackers until they develop new methods or identify flaws in our system. Glastopf features a modular design, enabling the addition of new logging capabilities or handlers for different attack types. It already supports various database functionalities. For centralized data collection, HPFeeds logging is integrated. Popular attack type emulation is already implemented, including Remote File Inclusion through a built-in PHP sandbox, Local File Inclusion that serves files from a virtual file system, and HTML injection via POST requests. Adversaries typically use search engines and specially crafted search queries to locate their targets. To attract these attackers, Glastopf provides relevant keywords (also known as 'dorks') and automatically extracts them from incoming requests, which expands its attack surface over time. As a result, the honeypot continuously evolves and increases its effectiveness.