[Name]
honeydet

[Version]
1.5.0 (git tag 1.5.0)

[Homepage]
https://github.com/referefref/honeydet

[Download]
https://github.com/referefref/honeydet/releases/tag/1.5.0
Source: https://github.com/referefref/honeydet/archive/refs/tags/1.5.0.tar.gz

[Author]
James Brine (referefref), https://jamesbrine.com.au

[Licence]
GPL-3.0 (from 1.5.0; earlier releases were CC BY-NC-SA 4.0). All code is by the author.

[Description]
honeydet is a signature-based honeypot detection tool written in Go. It sends specially crafted requests to network services and compares the responses with signatures of known honeypots, so that penetration testers and red teams can tell whether a host they are assessing is a decoy, and defenders can check how easily their own honeypots are fingerprinted.

• Multi-step signatures over TCP and UDP with string, hex and regex matching, inverted matches and no-response checks; SSH exec-mode checks with credentials; SNMP and Modbus probes.
• Ships with more than 200 signatures for about 40 open-source honeypot families (including Cowrie, Dionaea, OpenCanary, Conpot, h0neytr4p, Elasticsearch, database, Redis and web honeypots). Each signature has been tested against the honeypot and against the genuine service it imitates, to avoid false positives.
• Scans single hosts, CIDR ranges, IP ranges or host files, with configurable ports, threads, delay and timeout, and an optional ping check.
• JSON and CSV reports.
• Runs as a command-line tool, as a web interface with scan history (SQLite) and a signature library and tester, or as a web API on port 8888.
• Optional Shodan enrichment for public addresses.

[Dependencies]
Runtime: none (static Go binary, no CGO). Optional: a Shodan API key for -shodan.
Build: Go 1.26 or later (go.mod) and the following Go modules:
github.com/TwiN/go-color, github.com/gosnmp/gosnmp, github.com/simonvetter/modbus, github.com/tomsteele/go-shodan, go.yaml.in/yaml/v3, golang.org/x/crypto, modernc.org/sqlite (pure-Go SQLite) and their indirect dependencies (listed in go.mod/go.sum).
Data: signatures.yaml, searched in ./, ~/.config/honeydet/, next to the binary, /usr/local/share/honeydet/ and /usr/share/honeydet/ (a package would install it to /usr/share/honeydet/signatures.yaml). Scan history defaults to ~/.local/share/honeydet/scans.db. Web assets are embedded in the binary.

[Similar tools]

• Shodan Honeyscore (https://honeyscore.shodan.io): an online honeypot likelihood score for a single public IP; not self-hosted, cannot scan private networks, and does not show which honeypot or why.
• Nmap service detection (-sV): identifies some honeypots by banner but has no honeypot-specific, multi-step signatures.
• Single-honeypot detection scripts (for example detectors for Kippo/Cowrie): cover one honeypot each.
  honeydet differs in having a large, tested signature library across many honeypot families, multi-step and multi-protocol probes, and a self-hosted web interface and API.

[Activity]
Project started December 2023. Actively developed: releases 1.3.0 to 1.5.0 in October 2026 (engine fixes, web interface, multi-packet reads, standard file locations, GPL-3.0 licence), and signatures are added regularly as part of ongoing honeypot research for the book Deception Technology.

[How to install]
git clone https://github.com/referefref/honeydet.git
cd honeydet
git checkout 1.5.0
go build
sudo install -m 0755 honeydet /usr/bin/honeydet
sudo install -D -m 0644 signatures.yaml /usr/share/honeydet/signatures.yaml

Pre-built binaries are attached to each release.

[How to use]

Scan one host on its SSH port (verbose)

honeydet -host 192.0.2.10 -port 22 -v

# Scan a /24 on several ports with 50 threads and write a JSON report
honeydet -host 192.0.2.0/24 -port 21,22,23,80,443,3306,6379,9200 -threads 50 -report json -output report.json

# Hosts from a file, ping check first, 3 second timeout
honeydet -hostfile hosts.txt -port 22,80 -checkPing -timeout 3

# SSH checks that need a login (many SSH honeypots accept any password)
honeydet -host 192.0.2.10 -port 22 -u root -pw 'random-password'

# Run every signature against every port given, regardless of its default port
honeydet -host 192.0.2.10 -port 2222,8080 -bypassPortCheck

# Use a custom signature file
honeydet -host 192.0.2.10 -port 80 -signatures my_signatures.yaml

# Web interface and API on http://localhost:8888
honeydet -webserver
curl 'http://localhost:8888/scan?host=192.0.2.0/24&port=22,80'

# Show all options and file locations
honeydet -help

[Packaged]
Not packaged in any distribution yet. A Dockerfile and docker-compose.yml are included in the repository, and GoReleaser builds release archives for Linux (amd64, arm64, 386), macOS and Windows.