honeypot-auditor

.______________________________________________________________________________.
|  :: H-AUDITOR :: v1.0.4 :: "DIALING IN... CARRIER DETECTED" ::                |
|------------------------------------------------------------------------------|
|  "warez? nah. headers. we trade banners, not bins."                          |
|  "if it answers any password, it ain't production — it's a lure."            |
|  "respect the sysop. probe only what you own. leave no STOR behind."         |
|______________________________________________________________________________|

Does This Look Like An Honeypot? (DTLLAH) — Multi-protocol CLI that fingerprints whether a target IP behaves like an honeypot, implement different strategies to identify honeypots.

Site (BBS / NFO): https://mziqudhd92.github.io/honeypot-auditor/
Agents / AEO: llms.txt · agents.md

  ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
  █  >>> LIVE DEMO · v1.0.4 · DD-HONEYPOT · 5 SERVICES · -v / --deep <<<   █
  ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

  "five DataTrap faces on loopback: map the ports, run -v, then --deep.
   Honeyscore 100% — Confirmed Honeypot. same fingerprinter, new decoy."
                        — dd-honeypot lab · v1.0.4 · authorized only

.------------------------------------------------------------------------------.
|  NFO · READ BEFORE YOU DIAL                                                  |
|------------------------------------------------------------------------------|
|  Authorized targets ONLY. Lab boxes. Decoys you own. Sensors you run.        |
|  Permission on paper (or in ticket).                                         |
|                                                                              |
|  Scanning random /16 because Shodan said "interesting" = YOU are the bait.   |
|                                                                              |
|  TYPE ...... Multi-Protocol Decoy Fingerprinter / Lab Util                   |
|  PLATFORM .. Linux · macOS · Windows (Python 3.10+)                          |
|  LICENSE ... MIT · spread the sauce · keep the copyright                     |
|  PYPI ...... pypi.org/project/honeypot-auditor                               |
|  REPO ...... github.com/mziqudhd92/honeypot-auditor                          |
'------------------------------------------------------------------------------'

-=[ WHAT IS THIS ]=-

Honeypot Auditor — a CLI that asks one rude question:

Does this IP behave like a low-interaction honeypot, or like something that might actually bill someone for downtime?

Passive intel (Shodan Honeyscore) plus active, non-destructive probes across the usual decoy faces. Outputs a weighted Honeyscore (0–100%), Rich console table, versioned JSON report.

Quickstart Tutorials: AWS Spot honeypot lab · Local web UI (serve, XP.css)

  "localhost UI · IP-grouped history · Open a saved audit for the full tell tree."
                        — honeypot-auditor serve · XP.css · 127.0.0.1 only

  [ BASIC ]  passive intel · Nmap NSE · 34 protocol engines (TCP + UDP) · up to 3 strategies each
  [ DEEP  ]  shell semantics · OS coherence · HASSH · TCP stack · FSM fuzz
             · co-tenancy buffet detect · latency · latency-under-load · egress bait
             (flag: --deep · more intrusive · same authorization rules)

  "elite? nah. just consistent timeouts and a honest --confirm-authorized."

---

-=[ INSTALLATION ]=-

  ┌─ USERS · PyPI (public index — no pip config voodoo) ─────────────────────┐
  │  python3 -m venv .venv && source .venv/bin/activate   # recommended      │
  │  pip install honeypot-auditor                                            │
  │  pip install "honeypot-auditor[full]"    # + nmap impacket shodan scapy   │
  │  honeypot-auditor --version                                              │
  └──────────────────────────────────────────────────────────────────────────┘

Install	Unlocks
pip install honeypot-auditor	Core probes (Paramiko + Requests + Rich + figlet header)
pip install "honeypot-auditor[full]"	+ Nmap integration · SMB/Impacket · Shodan SDK · Scapy · deep telnet

SHODAN_API_KEY or --shodan-key enables Shodan OSINT (opt-in — not queried otherwise). [full] only installs the client lib. The Nmap executable is a separate trusted system installation.

Windows PowerShell uses py -m venv .venv followed by .\.venv\Scripts\Activate.ps1. Raw-socket probes can require Npcap and an elevated terminal; unavailable capabilities are reported and skipped.

First dial-in:

honeypot-auditor --help          # -h, --help, or /help (BBS figlet header)
honeypot-auditor --target 127.0.0.1

  ┌─ DEVELOPERS · from source ───────────────────────────────────────────────┐
  │  git clone https://github.com/mziqudhd92/honeypot-auditor.git            │
  │  cd honeypot-auditor && python3 -m venv .venv && source .venv/bin/activate│
  │  pip install -e ".[full,dev,security]"                                   │
  │  make test-cov && make lint && make security                             │
  └──────────────────────────────────────────────────────────────────────────┘

No pip install (git checkout — install minimal deps once):

pip install rich paramiko requests    # pyproject.toml is the single source of truth
python3 honeypot-auditor.py --help
python3 honeypot-auditor.py --target 127.0.0.1

pyfiglet / rich-argparse are optional for the script path (plain header + stdlib help if missing). Full probes need pip install -e ".[full]".

Release maintainers → docs/PUBLISHING.md

---

-=[ QUICKSTART / COMMANDS ]=-

# local lab · default probes IANA + docker/lab ports (22 and 2222, 80 and 8081, …)
honeypot-auditor --target 127.0.0.1

# go deep · six extra detection axes · still no exploits
honeypot-auditor --target 127.0.0.1 --deep

# internet-facing target · need explicit ack + Shodan key if you want intel
honeypot-auditor --target 203.0.113.10 --confirm-authorized