Skip to content

Commit 97b5568

Browse files
x4nth055x4nth055
committed
add honeypot defense system tutorial
1 parent 6f875e9 commit 97b5568

4 files changed

Lines changed: 236 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ This is a repository of all the tutorials of [The Python Code](https://www.thepy
2121
- [How to Perform IP Address Spoofing in Python](https://thepythoncode.com/article/make-an-ip-spoofer-in-python-using-scapy). ([code](scapy/ip-spoofer))
2222
- [How to See Hidden Wi-Fi Networks in Python](https://thepythoncode.com/article/uncovering-hidden-ssids-with-scapy-in-python). ([code](scapy/uncover-hidden-wifis))
2323
- [Crafting Dummy Packets with Scapy Using Python](https://thepythoncode.com/article/crafting-packets-with-scapy-in-python). ([code](scapy/crafting-packets))
24+
- [Building a Honeypot Defense System with Python and Scapy](https://thepythoncode.com/article/python-scapy-honeypot-port-scan-detection-system). ([code](scapy/honeypot-defense-system))
2425
- [Writing a Keylogger in Python from Scratch](https://www.thepythoncode.com/article/write-a-keylogger-python). ([code](ethical-hacking/keylogger))
2526
- [Making a Port Scanner using sockets in Python](https://www.thepythoncode.com/article/make-port-scanner-python). ([code](ethical-hacking/port_scanner))
2627
- [How to Create a Reverse Shell in Python](https://www.thepythoncode.com/article/create-reverse-shell-python). ([code](ethical-hacking/reverse_shell))

‎scapy/honeypot-defense-system/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# [Building a Honeypot Defense System with Python and Scapy](https://thepythoncode.com/article/python-scapy-honeypot-port-scan-detection-system)
2+
Requires Linux or Windows with WSL, Python 3.8+, and Scapy. Install Scapy using `pip install scapy` or refer to the [Scapy installation guide](https://scapy.readthedocs.io/en/latest/installation.html) for detailed instructions.
3+
4+
Read the full article on [ThePythonCode](https://thepythoncode.com/article/python-scapy-honeypot-port-scan-detection-system) for a step-by-step tutorial on building a honeypot defense system using Python and Scapy.

‎scapy/honeypot-defense-system/block_port_scan.py‎

Lines changed: 230 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,230 @@
1+
#!/usr/bin/env python3
2+
"""
3+
Honeypot Defense System
4+
Detects port scanners using decoy ports and blocks malicious IPs
5+
"""
6+
7+
from scapy.all import *
8+
from datetime import datetime
9+
import sys
10+
11+
# ==================== NETWORK INTERFACE ====================
12+
conf.iface = "enp0s8" # Specify your network interface
13+
14+
# ==================== CONFIGURATION ====================
15+
DEFENDER_IP = "192.168.56.101" # Change this to your Ubuntu IP
16+
17+
# Three-tier port system
18+
PUBLIC_PORTS = [80] # Open to everyone (realistic services)
19+
HONEYPOT_PORTS = [8080, 8443, 3389, 3306] # Decoy ports to trap attackers
20+
PROTECTED_PORTS = [443, 53, 22, 5432] # Hidden unless IP is allowed
21+
22+
ALLOWED_IPS = [
23+
"192.168.1.100", # Add your Kali IP here
24+
"192.168.1.1", # Add other trusted IPs
25+
]
26+
MAX_ATTEMPTS = 3 # Block after this many honeypot accesses (changeable)
27+
LOG_FILE = "honeypot_logs.txt"
28+
29+
# ==================== GLOBALS ====================
30+
blocked_ips = []
31+
attempt_tracker = {} # {IP: attempt_count}
32+
total_scans = 0
33+
total_blocks = 0
34+
35+
# ==================== HELPER FUNCTIONS ====================
36+
37+
def log_message(message, color_code=None):
38+
"""Print and save log messages with timestamps"""
39+
timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
40+
log_entry = f"[{timestamp}] {message}"
41+
42+
# Color output for terminal
43+
if color_code:
44+
print(f"\033[{color_code}m{log_entry}\033[0m")
45+
else:
46+
print(log_entry)
47+
48+
# Save to file
49+
with open(LOG_FILE, "a") as f:
50+
f.write(log_entry + "\n")
51+
52+
53+
def is_allowed_ip(ip):
54+
"""Check if IP is in the allowlist"""
55+
return ip in ALLOWED_IPS
56+
57+
58+
def track_attempt(ip):
59+
"""Track honeypot access attempts and return current count"""
60+
if ip not in attempt_tracker:
61+
attempt_tracker[ip] = 0
62+
attempt_tracker[ip] += 1
63+
return attempt_tracker[ip]
64+
65+
66+
def block_ip(ip):
67+
"""Add IP to blocklist"""
68+
global total_blocks
69+
if ip not in blocked_ips:
70+
blocked_ips.append(ip)
71+
total_blocks += 1
72+
log_message(f"[!] IP BLOCKED: {ip}", "91") # Red
73+
74+
75+
def create_response(packet, flags):
76+
"""Create a TCP response packet"""
77+
if packet.haslayer(IP):
78+
response = (
79+
Ether(src=packet[Ether].dst, dst=packet[Ether].src) /
80+
IP(src=packet[IP].dst, dst=packet[IP].src) /
81+
TCP(
82+
sport=packet[TCP].dport,
83+
dport=packet[TCP].sport,
84+
flags=flags,
85+
seq=0,
86+
ack=packet[TCP].seq + 1
87+
)
88+
)
89+
else: # IPv6
90+
response = (
91+
Ether(src=packet[Ether].dst, dst=packet[Ether].src) /
92+
IPv6(src=packet[IPv6].dst, dst=packet[IPv6].src) /
93+
TCP(
94+
sport=packet[TCP].dport,
95+
dport=packet[TCP].sport,
96+
flags=flags,
97+
seq=0,
98+
ack=packet[TCP].seq + 1
99+
)
100+
)
101+
return response
102+
103+
104+
# ==================== MAIN PACKET HANDLER ====================
105+
106+
def handle_packet(packet):
107+
"""Process incoming TCP packets with three-tier security"""
108+
global total_scans
109+
110+
# Only process SYN packets (connection attempts)
111+
if packet[TCP].flags != "S":
112+
return
113+
114+
# Extract source IP and destination port
115+
if packet.haslayer(IP):
116+
source_ip = packet[IP].src
117+
else:
118+
source_ip = packet[IPv6].src
119+
120+
dest_port = packet[TCP].dport
121+
total_scans += 1
122+
123+
# ===== CHECK IF IP IS BLOCKED FIRST =====
124+
if source_ip in blocked_ips:
125+
# Drop packet silently - no response to show as "filtered" in nmap
126+
log_message(f"[-] Blocked IP {source_ip} denied access to port {dest_port}", "90")
127+
return # Don't send any response - this makes it appear "filtered"
128+
129+
# ===== PUBLIC PORTS (open to everyone) =====
130+
if dest_port in PUBLIC_PORTS:
131+
# Let the real service handle it - no response needed from script
132+
log_message(f"[+] Public port {dest_port} accessed by {source_ip}", "94") # Blue
133+
return
134+
135+
# ===== HONEYPOT PORTS (trap for attackers) =====
136+
if dest_port in HONEYPOT_PORTS:
137+
# Always respond with SYN-ACK to appear "open"
138+
response = create_response(packet, "SA")
139+
sendp(response, verbose=False)
140+
141+
# Check if IP is allowed
142+
if is_allowed_ip(source_ip):
143+
log_message(
144+
f"[+] HONEYPOT ACCESS from {source_ip}:{dest_port}\n"
145+
f"[!] Status: TRUSTED IP (allowed)",
146+
"92" # Green
147+
)
148+
else:
149+
# Track attempts for unknown IPs
150+
attempts = track_attempt(source_ip)
151+
log_message(
152+
f"[!] HONEYPOT ACCESS from {source_ip}:{dest_port}\n"
153+
f"[-] Status: UNKNOWN IP - POTENTIAL ATTACKER\n"
154+
f"[!] Strike {attempts}/{MAX_ATTEMPTS}",
155+
"93" # Yellow
156+
)
157+
158+
# Block after max attempts
159+
if attempts >= MAX_ATTEMPTS:
160+
block_ip(source_ip)
161+
return
162+
163+
# ===== PROTECTED PORTS (only allowed IPs) =====
164+
if dest_port in PROTECTED_PORTS:
165+
if is_allowed_ip(source_ip):
166+
# Respond with SYN-ACK for allowed IPs
167+
response = create_response(packet, "SA")
168+
sendp(response, verbose=False)
169+
log_message(f"[!] Protected port {dest_port} accessed by TRUSTED IP {source_ip}", "92")
170+
else:
171+
# Drop packet silently for unknown IPs (appears filtered)
172+
log_message(f"[!] Protected port {dest_port} hidden from {source_ip}", "93")
173+
return
174+
175+
# ===== OTHER PORTS (default behavior - drop silently) =====
176+
# Unknown ports are silently dropped (appear filtered)
177+
178+
179+
# ==================== STARTUP & MAIN ====================
180+
181+
def print_banner():
182+
"""Display startup information"""
183+
print("\n" + "="*60)
184+
print("[+] HONEYPOT DEFENSE SYSTEM ACTIVE")
185+
print("="*60)
186+
print(f"Defending IP: {DEFENDER_IP}")
187+
print(f"Public Ports (open to all): {PUBLIC_PORTS}")
188+
print(f"Honeypot Ports (trap): {HONEYPOT_PORTS}")
189+
print(f"Protected Ports (allowed IPs only): {PROTECTED_PORTS}")
190+
print(f"Allowed IPs: {ALLOWED_IPS}")
191+
print(f"Block Threshold: {MAX_ATTEMPTS} attempts")
192+
print(f"Log File: {LOG_FILE}")
193+
print("="*60)
194+
print("Monitoring traffic... Press Ctrl+C to stop\n")
195+
196+
197+
def print_summary():
198+
"""Display statistics on exit"""
199+
print("\n" + "="*60)
200+
print("[+] SESSION SUMMARY")
201+
print("="*60)
202+
print(f"Total scans detected: {total_scans}")
203+
print(f"IPs blocked: {total_blocks}")
204+
print(f"Current blocklist: {blocked_ips if blocked_ips else 'None'}")
205+
print("="*60 + "\n")
206+
207+
208+
def main():
209+
"""Main execution"""
210+
print_banner()
211+
212+
# Create BPF filter
213+
packet_filter = f"dst host {DEFENDER_IP} and tcp"
214+
215+
try:
216+
# Start sniffing
217+
sniff(filter=packet_filter, prn=handle_packet, store=False)
218+
except KeyboardInterrupt:
219+
print("\n\n[!] Stopping honeypot defense...")
220+
print_summary()
221+
sys.exit(0)
222+
223+
224+
if __name__ == "__main__":
225+
# Check for root privileges
226+
if os.geteuid() != 0:
227+
print("[!] This script requires root privileges. Run with: sudo python3 honeypot_defender.py")
228+
sys.exit(1)
229+
230+
main()

‎scapy/honeypot-defense-system/requirements.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
scapy

0 commit comments

Comments
 (0)