HoneyLib 1.1.0

HoneyLib

Managing honeypots. Made easy.

HoneyLib is a library to make managing honeypots easier.

Features

• Per-IP logging
• Different logging options
• Report suspicious activity to AbuseIPDB

This library allows you to manage logging and reporting suspicious IPs that hit your honeypots. The library supports per-IP logging, logging of reports, advanced logging etc!

Usage

We use .NET 6 to run HoneyLib.

Create a honeypot, to link HoneyLib create an object like this

HoneyPot hp = new HoneyPot();
// or
HoneyPot hp2 = new HoneyPot("AbuseIPDB_TOKEN_HERE!");

Then define logging level like this:

hp.LoggingLevel = (int)HoneyPot.Logging.StdOut;
// or
hp.LoggingLevel = (int)(HoneyPot.Logging.StdOut | HoneyPot.Logging.LogConnections);

To change the token at any time use:

hp.AbuseIPDB = null; // to disable reports
hp.AbuseIPDB = "token"; // to set a new token

To access reports use this:

hp.Report("IP addresss", $"{hp.Time()} Unauthorized access!", (int)HoneyPot.ReportType.Hacking);
// or
hp.Report(server.AcceptTcpClient(), $"{hp.Time()} Evil person!", (int)HoneyPot.ReportType.Scanning);

Different types of logging are allowed, too:

// Dependent logging (useful for TCP applications)
hp.LoggingLevel = (int)(HoneyPot.Logging.StdOut | HoneyPot.Logging.LogConnections);
TcpClient client = tcp.AcceptTcpClient();
string hostname = hp.GetHost(client);
int port = hp.GetPort(client);
hp.Connect(client); // adds connection log to main file
hp.Log(client, $"Is a bad guy!"); // adds a log to per-IP logger for this IP
hp.Disconnect(client); // adds a connection terminated log, terminates FileStream for log

// Independent logging (useful for web, UDP applications, or when you don't want to manually keep track of connected users)
hp.LoggingLevel = (int)HoneyPot.Logging.StdOut;
TcpClient client = tcp.AcceptTcpClient();
string hostname = hp.GetHost(client);
int port = hp.GetPort(client);
hp.Log($"Client {hostname}:{port} connected to 127.0.0.1:80");
hp.Log(client, "Is a bad guy!");
hp.Log($"Client {hostname}:{port} had disconnected.");

NLog

Since 1.1.0 we are using NLog, so you can configure how exactly it operates. HoneyLib doesn't have any logging presets by default, so make sure you configure NLog in your own projects!!!