Log4j Honeypot Flask

Overview

The log4j-honeypot-flask is an innovative internal network security tool designed to detect potential threats from attackers or insider threats, specifically targeting vulnerabilities linked to log4j CVE-2021-44228. This honeypot can easily be deployed on either a workstation or a server, offering flexibility in its implementation. By monitoring suspicious activities, it ensures that any unusual pattern in requests is promptly reported, helping organizations maintain a vigilant stance against unauthorized access.

What sets this honeypot apart is its low-interaction nature, meaning it does not allow attackers to exploit it or gain access to sensitive data. Instead, it acts as a silent watchdog, silently until something suspicious is detected, at which point it sends alerts via popular communication platforms like Teams or Slack.

Features

• Easy Installation: Can be set up via Python script or Docker container, ensuring quick deployment with minimal setup requirements.

• Environment Configuration: Users can customize the honeypot with environment variables like the webhook URL for alerts, making it adaptable to different environments.

• Unique Identification: The honeypot can be assigned a unique name, allowing for easy tracking of alerts and suspicious activities within your network.

• Customizable Port Listening: Users can specify the port on which the honeypot listens, providing the flexibility to fit specific network configurations.

• Low-Interaction Design: This honeypot is designed for active defense without allowing attackers to exploit it, ensuring that your core systems remain safe.

• Real-Time Alerts: Sends alerts directly to your chosen communication platform (Teams, Slack, or Mattermost) whenever suspicious requests are detected, enabling immediate response.

• Pattern Recognition: Monitors form fields and HTTP headers for known suspicious string patterns, significantly enhancing proactive network security measures.