Honeypot Linux distribution

HoneyDrive is the premier honeypot Linux distro. It is a virtual appliance (OVA) with Xubuntu Desktop 12.04.4 LTS edition installed.

It contains over 10 pre-installed and pre-configured honeypot software packages such as Kippo SSH honeypot, Dionaea and Amun malware honeypots, Honeyd low-interaction honeypot, Glastopf web honeypot and Wordpot, Conpot SCADA/ICS honeypot, Thug and PhoneyC honeyclients and more. Additionally it includes many useful pre-configured scripts and utilities to analyze, visualize and process the data it can capture, such as Kippo-Graph, Honeyd-Viz, DionaeaFR, an ELK stack and much more.

Lastly, almost 90 well-known malware analysis, forensics and network monitoring related tools are also present in the distribution.

The latest version of HoneyDrive Desktop, released on July 2014, is hosted at SourceForge.net: http://sourceforge.net/projects/honeydrive/

After downloading the file, you simply have to import the virtual appliance to your virtual machine manager. The recommended virtualization software is Oracle VM VirtualBox; a simple double click on the OVA file is enough.

* Virtual appliance based on Xubuntu 12.04.4 LTS Desktop.
* Distributed as a single OVA file, ready to be imported.
* Full LAMP stack installed (Apache 2, MySQL 5), plus tools such as phpMyAdmin.
* Kippo SSH honeypot, plus Kippo-Graph, Kippo-Malware, Kippo2MySQL and other helpful scripts.
* Dionaea malware honeypot, plus DionaeaFR and other helpful scripts.
* Amun malware honeypot, plus helpful scripts.
* Glastopf web honeypot, along with Wordpot WordPress honeypot.
* Conpot SCADA/ICS honeypot.
* Honeyd low-interaction honeypot, plus Honeyd2MySQL, Honeyd-Viz and other helpful scripts.
* LaBrea sticky honeypot, Tiny Honeypot, IIS Emulator and INetSim.
* Thug and PhoneyC honeyclients for client-side attacks analysis, along with Maltrieve malware collector.
* ELK stack: ElasticSearch, Logstash, Kibana for log analysis and visualization.
* A full suite of security, forensics and anti-malware tools for network monitoring, malicious shellcode and PDF analysis, such as ntop, p0f, EtherApe, nmap, DFF, Wireshark, Recon-ng, ClamAV, ettercap, MASTIFF, Automater, UPX, pdftk, Flasm, Yara, Viper, pdf-parser, Pyew, Radare2, dex2jar and more.
* Firefox add-ons pre-installed, plus extra helpful software such as GParted, Terminator, Adminer, VYM, Xpdf and more.