HoneyLib 1.0.1

HoneyLib

Managing honeypots. Made easy.

HoneyLib is a library to make managing honeypots easier.

Features

• Per-IP logging
• Different logging options
• Report suspicious activity to AbuseIPDB

This library allows you to manage logging and reporting suspicious IPs that hit your honeypots. The library supports per-IP logging, logging of reports, advanced logging etc!

Usage

We use .NET 6 to run HoneyLib.

Create a honeypot, to link HoneyLib create an object like this

HoneyPot hp = new HoneyPot();
// or
HoneyPot hp2 = new HoneyPot("AbuseIPDB_TOKEN_HERE!");

Then define logging level like this:

hp.LoggingLevel = (int)HoneyPot.Logging.StdOut;
// or
hp.LoggingLevel = (int)(HoneyPot.Logging.StdOut | HoneyPot.Logging.LogConnections);

To change the token at any time use:

hp.AbuseIPDB = null; // to disable reports
hp.AbuseIPDB = "token"; // to set a new token

To access reports use this:

hp.Report("IP addresss", $"{hp.Time()} Unauthorized access!", (int)HoneyPot.ReportType.Hacking);
// or
hp.Report(server.AcceptTcpClient(), $"{hp.Time()} Evil person!", (int)HoneyPot.ReportType.Scanning);

Different types of logging are allowed, too:

// Dependent logging (useful for TCP applications)
hp.LoggingLevel = (int)(HoneyPot.Logging.StdOut | HoneyPot.Logging.LogConnections);
TcpClient client = tcp.AcceptTcpClient();
string hostname = hp.GetHost(client);
int port = hp.GetPort(client);
hp.Connect(client); // adds connection log to main file
hp.Log(client, $"Is a bad guy!"); // adds a log to per-IP logger for this IP
hp.Disconnect(client); // adds a connection terminated log, terminates FileStream for log

// Independent logging (useful for web, UDP applications, or when you don't want to manually keep track of connected users)
hp.LoggingLevel = (int)HoneyPot.Logging.StdOut;
TcpClient client = tcp.AcceptTcpClient();
string hostname = hp.GetHost(client);
int port = hp.GetPort(client);
hp.Log($"Client {hostname}:{port} connected to 127.0.0.1:80");
hp.Log(client, "Is a bad guy!");
hp.Log($"Client {hostname}:{port} had disconnected.");