atirathi/iot-honeypot
GitHub: atirathi/iot-honeypot
一个多协议 IoT 蜜罐系统，通过模拟 Telnet、SSH、HTTP、MQTT 服务来诱捕攻击者并采集威胁情报数据。
Stars: 0 | Forks: 0
# IoT Honeypot
用于威胁情报收集的多协议 IoT Honeypot。
```
Telnet :23 SSH :22 HTTP :80 MQTT :1883
```
## 架构
```
graph TB
subgraph Attackers
A[Internet Scanners]
B[Botnets]
C[Threat Actors]
end
subgraph Honeypot
T[Telnet :23]
S[SSH :22]
H[HTTP :80]
M[MQTT :1883]
end
subgraph Pipeline
R[(Redis Streams)]
D[(TimescaleDB)]
E[Event Bus]
end
subgraph Observability
API[FastAPI :8080]
UI[Web Dashboard]
G[Grafana :3000]
AL[Webhook Alerter]
end
A --> T & S & H & M
B --> T & S & H & M
C --> T & S & H & M
T --> E
S --> E
H --> E
M --> E
E --> R
E --> D
E --> AL
API --> R & D
UI --> API
G --> D
```
## 文档
| 文档 | 内容 |
|----------|----------|
| [架构](docs/ARCHITECTURE.md) | 系统设计、数据流、容器模型 |
| [部署](docs/DEPLOYMENT.md) | Docker、本地开发、生产环境、监控 |
| [协议](docs/PROTOCOLS.md) | Telnet/SSH/HTTP/MQTT Honeypot 规范 |
| [API 参考](docs/API.md) | REST endpoint、认证、示例 |
| [配置](docs/CONFIGURATION.md) | 所有环境变量、默认值、描述 |
| [开发](docs/DEVELOPMENT.md) | 设置、测试、添加协议 |
## 快速开始
```
git clone
cd iot-honeypot
# Docker 部署
docker compose up -d
# 验证
curl http://localhost:8080/health
curl http://localhost:8080/dashboard
```
## 攻击模拟
```
telnet localhost 23 # login: root/admin, any password
ssh root@localhost # any password accepted
curl http://localhost/ # router login page
mosquitto_pub -h localhost \
-t home/temp -m "25.5" # MQTT publish
```
## 仪表盘
- **Web UI**: http://localhost:8080/dashboard
- **Grafana**: http://localhost:3000 (admin/admin)
- **API**: http://localhost:8080/docs
## 许可证
MIT
标签：AV绕过, Docker, FastAPI, PE 加载器, Python, Redis, 威胁情报, 安全防御评估, 开发者工具, 搜索引擎查询, 攻防研究, 无后门, 版权保护, 物联网安全, 蜜罐, 证书利用, 请求拦截, 逆向工具