v0.37.0 — source analysis research published

Source analysis research published

All 30 honeypot detection signatures in galleria trace back to bugs and hardcoded values found during direct source code audits. The full research is now in the repo at docs/honeypot-research/ — 29 files, one per honeypot, each covering 5 parallel audit lanes (injection/auth, protocol correctness, fingerprint/evasion surface, logging, coding errors).

What the audits found

Every fingerprint is sourced from one of two bug classes:

Hardcoded values — single-packet, pre-auth identification, near-zero false-positive rate:

• MysqlPot — auth scramble is always BBBBBBBBBBBB (12 bytes of 0x42, MysqlDefs.cs). Real MySQL generates a random 20-byte nonce.
• Cowrie — SSH banner hardcoded to SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2 (2012). KEXINIT packets null-padded; real OpenSSH pads with random bytes. Detectable passively before any auth attempt.
• pghoney — MD5 auth salt identical across every connection and every deployment (serverutils.go:67).
• sticky_elephant — backend PID always reported as 666 in ParameterStatus messages (postgres_simulator.rb).
• Dionaea — SIP digest nonce hardcoded to foobar123 across all deployments.
• Conpot — SNMP sysLocation hardcoded to "Venus"; Guardian AST station name hardcoded to "STATOIL STATION".
• OpenCanary — MSSQL NTLM challenge blob contains the string thinkst.com verbatim.
• elastichoney / elasticpot — node UUID, MAC address, and build hash identical across every deployment worldwide.
• Lophiid — SendStatus explicitly documented as unauthenticated in source (backend.go:626): // SendStatus is not authenticated.

Behavioral bugs — implementation errors detectable via protocol-level dialog:

• Dionaea Memcache — SET foo bar → GET foo returns END instead of VALUE foo. Fresh FakeRedis instance created per data event; state never persists.
• Dionaea MQTT — CONNECT with garbage credentials returns CONNACK 0x00 (accepted). Real brokers return 0x05 (refused).
• Dionaea SIP — INVITE without Authorization accepted unconditionally. Real SIP servers challenge with 407.
• nosqlpot — AUTH missing from Redis dispatch table entirely (redisdeploy.py:75). Returns unknown command 'auth'; real Redis returns -NOAUTH Authentication required.
• MongoDB-HoneyProxy — no OP_MSG handler; messages silently dropped. Real MongoDB responds.
• OpenCanary MSSQL — bytes.find(str) raises TypeError in Python 3 on the first valid TDS PRELOGIN packet (mssql.py:129). Handler crashes before logging anything.
• sticky_elephant — authenticate() calls send_authentication_ok without checking the password. Every credential, including random garbage, is accepted.
• Honeyd FTP — SYST returns Windows_NT on Linux hosts.

Full architecture and competitive comparison vs. honeyscore, nmap NSE, and nuclei templates: docs/ARCHITECTURE.md.

Install

go install github.com/sshpie/galleria@latest