Thug
The number of client-side attacks has grown significantly in the past few years shifting focus on poorly protected vulnerable clients. Just as the most known honeypot technologies enable research into server-side attacks, honeyclients allow the study of client-side attacks.
A complement to honeypots, a honeyclient is a tool designed to mimic the behavior of a user-driven network client application, such as a web browser, and be exploited by an attacker’s content.
Thug is a Python low-interaction honeyclient aimed at mimicking the behavior of a web browser in order to detect and emulate malicious contents.
Documentation
Documentation about Thug installation and usage can be found at http://thug-honeyclient.readthedocs.io/.
Contributions
Thug is open source and we welcome contributions in all forms!
Thug is free to use for any purpose (even commercial ones). If you use and appreciate Thug, please consider supporting the project with a donation using Paypal.
Testing
To run the full test suite using tox, run the command:
toxSince tox builds and installs dependencies from scratch, using pytest for faster testing is recommended:
pytest --cov thugLicense information
Copyright (C) 2011-2026 Angelo Dell’Aera <angelo.dellaera@honeynet.org>
License: GNU General Public License, version 2
1 maintainer
Metadata
1 maintainer
Release files for thug 6.22
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| thug-6.22.tar.gz | 187.8 kB | Details |
Release files / thug-6.22.tar.gz
| Download URL | thug-6.22.tar.gz |
|---|---|
| Size | 187.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
53bdf1f5e773a2a17e0e90b8069ee40d3b5aa75b184f940e1bf8f4bcf9d46a47
|
|
BLAKE2b-256 checksum How to use checksums |
4a4d5fcee18aa9b4620f15955e5b26fd797a0be636562917c7160f9b3ddc1f4f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 11, 2026.
Transparency log
