redispot 2.0.0

A RedisB Honeypot

RedisPot: a RedisDB Honeypot

This is a honeypot simulating a RedisDB server. It borrows some ideas from the honeypots package. However, it has many improvements. It supports the inline protocol (i.e., AUTH user password\r) in addition to the bulk protocol (i.e., *3\r\n$4\r\nAUTH\r\n$4\r\nuser\r\n$8\r\npassword\r\n), which the original does not and which, incidentally, all credential stuffing attacks use; it fixes several bugs in the original (which assumes in a couple of places that numbers can be only be single-digit - not a very safe assumption); it has many output plugins and so on.

The honeypot does not emulate a full RedisDB server with databases and so on - it only records the IP of the attacker, as well as the username and password used, if any, and returns a "bad login credentials" error.

Prerequisites

• a working database server (only if you use an output plugin that outputs to a database - e.g., MySQL)

Usage

Check the Linux installation guide or the Windows installation guide for complete instructions on how to install, configure, and run the honeypot.