Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

186 lines (119 sloc) 4.779 kb
The number of client-side attacks has grown significantly in the past
few years shifting focus on poorly protected vulnerable clients. Just
as the most known honeypot technologies enable research into server-side
attacks, honeyclients allow the study of client-side attacks.
A complement to honeypots, a honeyclient is a tool designed to mimic
the behavior of a user-driven network client application, such as a web
browser, and be exploited by an attacker’s content.
Thug is a Python low-interaction honeyclient aimed at mimicing the
behavior of a web browser in order to detect and emulate malicious
- Python 2.7
- Google V8
- PyV8
- Beautiful Soup 4
- Html5lib
- Libemu
- Pylibemu
- Pefile
- Chardet
- httplib2 0.7.4 or later
- Zope interface
- MongoDB (optional)
- PyMongo (optional)
- BeautifulSoup 4
Currently the best way to install Beautiful Soup 4 is through `easy_install'
because it is still in beta release. Beautiful Soup 4 is published through
PyPi, so you can install it with easy_install or pip. The package name is
beautifulsoup4, and the same package works on Python 2 and Python 3.
# easy_install beautifulsoup4
or alternatively
# pip install beautifulsoup4
- V8/PyV8
In order to properly install V8 and PyV8 please follow the procedure
described below.
1. Checkout V8 source code from SVN
$ svn checkout v8
2. Patch V8 source code with the patches you can find in thug/patches
$ cp thug/patches/V8-patch* .
$ patch -p0 < V8-patch1.diff
patching file v8/src/log.h
$ patch -p0 < V8-patch2.diff
patching file v8/src/parser.h
Hunk #1 succeeded at 456 (offset 7 lines).
3. Checkout PyV8 source code from SVN
$ svn checkout pyv8
4. Set the environment variable V8_HOME with the V8 source code
absolute path (you need to change the value reported below)
$ export V8_HOME=/home/buffer/v8
5. Move to PyV8 source code directory
$ cd pyv8
6. Build and install (PyV8 will properly install both V8
and PyV8)
~/pyv8 $ python build
~/pyv8 $ sudo python install
7. Test the installation
~/pyv8 $ python
If no problems occur, you have successfully installed V8 and PyV8.
In order to install the other required libraries and packages please
follow installation procedures as specified in their documentation.
~/thug/src $ python -h
Thug: Pure Python honeyclient implementation
python [ options ] url
-h, --help Display this help information
-o, --output= Log to a specified file
-r, --referer= Specify a referer
-p, --proxy= Specify a proxy (see below for format and supported schemes)
-l, --local
-v, --verbose Enable verbose mode
-d, --debug Enable debug mode
-u, --useragent= Select a user agent (see below for values, default: xpie61)
Proxy Format:
scheme://[username:password@]host:port (supported schemes: http, socks4, socks5)
Available User-Agents:
xpie60 Internet Explorer 6.0 (Windows XP)
xpie61 Internet Explorer 6.1 (Windows XP)
xpie70 Internet Explorer 7.0 (Windows XP)
xpie80 Internet Explorer 8.0 (Windows XP)
w2kie60 Internet Explorer 6.0 (Windows 2000)
w2kie80 Internet Explorer 8.0 (Windows 2000)
HPFeeds is the Honeynet Project central logging feature and it is enabled by default
in Thug. If you don't want to report your events and samples, you can turn off HPFeeds
by modifying the configuration file src/Logging/logging.conf.
If you are interested in the data collected by Thug instances, please contact me at
License information
Copyright (C) 2011-2012 Angelo Dell'Aera <>
License: GNU General Public License, version 2 or later; see COPYING.txt
included in this archive for details.
Take a look at for additional details about
the project and if you appreciate Thug please consider making a small
Jump to Line
Something went wrong with that request. Please try again.