BaitBox is a zero-config, multi-protocol honeypot for homelabbers and security researchers. Drop attackers into a stateful fake filesystem, watch them try to pivot, and get real-time alerts — all from a beautiful cyber command-center dashboard.

• 🛡️ Multi-Protocol Honeypot: Simultaneously traps SSH, HTTP, and Telnet attackers.
• 🎭 Stateful Fake Filesystem (VFS): SSH attackers are dropped into a convincing virtual Linux machine with realistic files: ~/.bash_history, ~/.bashrc (with fake DB passwords), ~/.ssh/authorized_keys, /var/www/html/.env, /etc/shadow, /etc/crontab, Nginx config, MySQL dumps, auth logs, and more.
• 💻 70+ Fake Shell Commands: Full interactive shell with ls -la (hidden files), cd ~, cat, grep, find, ps aux, netstat, ifconfig/ip, who, last, df, free, top, crontab -l, python3 -c, mysql, git log, systemctl status, nmap, wget/curl, ping, vi/nano, chmod, chown, useradd, passwd, tar, gzip, zip, unzip, which, whereis, man, dpkg, apt, yum, echo with redirection, shell script execution, history navigation (↑ arrow), Ctrl+C, Ctrl+D.
• 📡 Telnet Honeypot: An asyncio-powered Telnet server on port 2323 that captures credentials and commands.
• 📊 Premium Dashboard: A stunning, pure-vanilla-CSS cyber command center with:
  • Live GeoIP Attack Map (server-side resolution, cached, no API key needed)
  • Threat Score Indicators (🔴 HIGH / 🟡 MED / 🟢 LOW per attacker)
  • 24-Hour Event Timeline chart
  • Protocol Split donut chart
  • Real-time event stream with pause/resume
  • IP Block/Unblock controls — one click blocks an IP and terminates their sessions
  • Top Offending IPs, Top Passwords, Top HTTP Paths leaderboards
  • Active Intruder Controller — live session view with BOOT/BLOCK/MAP buttons
• 🔐 Dashboard Authentication: Login-protected dashboard with bcrypt-hashed credentials and JWT session tokens.
• 🔔 Webhook Notifications: Discord and Slack alerts for auth attempts, commands, and decoy hits.
• 📈 Anomaly Detection: Real-time per-IP threat scoring with pattern analysis for rapid auth attempts, high-risk commands, privilege escalation, and sensitive file access.
• 🚫 IP Rate Limiting & Block List: Automatic connection tracking; manually block IPs from the dashboard.
• 🐘 PostgreSQL Support: Optional PostgreSQL backend for production-grade persistence via Docker Compose.
• 🐳 Zero-Config Docker: Full honeypot + dashboard in 5 seconds.
• 🔒 Enhanced Security: Input validation, command length limits, CORS support, and secure configuration defaults.
• 🧹 Automatic Session Cleanup: Background task to clean up stale SSH sessions (configurable).
• 📝 Structured Logging: Comprehensive logging with timestamps and log levels for debugging and monitoring.
• ⚡ Performance Optimizations: PostgreSQL connection pooling, enhanced caching, and optimized database queries.

docker run -d \
  --name baitbox \
  -p 2222:2222 \
  -p 2323:2323 \
  -p 8000:8000 \
  ghcr.io/qylen/baitbox:latest

Open http://localhost:8000 to see the dashboard.
Login with admin / admin (change via env vars in production!).

git clone https://github.com/qylen/baitbox.git
cd baitbox
docker compose up -d

This starts BaitBox with a PostgreSQL database for production workloads. See docker-compose.yml for configuration.

git clone https://github.com/qylen/baitbox.git
cd baitbox
pip install -r requirements.txt
python -m baitbox.main

(login: admin / admin)

SSH Honeypot:

ssh root@localhost -p 2222
# Enter any password (e.g. admin123)
# Try: ls -la, cat /root/secrets.txt, cat /var/www/html/.env, grep DB_PASS /root/.bashrc

Telnet Honeypot:

telnet localhost 2323
# Enter any username/password

HTTP Decoys:

curl http://localhost:8000/wp-admin
curl http://localhost:8000/.env
curl http://localhost:8000/.git/config

Then open http://localhost:8000 and watch your actions appear on the dashboard in real-time.

The dashboard requires authentication. Default credentials:

All /api/* endpoints and the /ws/feed WebSocket require a valid JWT session cookie or bearer token. Unauthenticated API requests return 401 Unauthorized, unauthenticated WebSocket handshakes are rejected with 403 Forbidden, and unauthenticated dashboard visits are redirected to /login.

All settings are via environment variables:

BaitBox includes a real-time anomaly detection engine that scores each attacker IP based on behavioral patterns:

Threat levels: 🟢 LOW (0–29) · 🟡 MEDIUM (30–69) · 🔴 CRITICAL (70–100)

Scores are displayed per-session on the dashboard and included in webhook notifications.

baitbox/
├── baitbox/
│   ├── anomaly.py         # Real-time anomaly detection engine
│   ├── config.py          # Settings from environment variables
│   ├── db.py              # Database abstraction layer (SQLite/PostgreSQL)
│   ├── db_sqlite.py       # SQLite persistence backend
│   ├── db_postgres.py     # PostgreSQL persistence backend
│   ├── geoip.py           # Server-side GeoIP with threat scoring
│   ├── main.py            # Entry point (starts all servers)
│   ├── pubsub.py          # Asyncio pub/sub for WebSocket broadcasting
│   ├── ratelimit.py       # IP rate limiting and block list
│   ├── sessions.py        # Active SSH session manager
│   ├── vfs.py             # Virtual filesystem for SSH honeypot
│   ├── webhooks.py        # Discord/Slack/generic webhook notifications
│   ├── servers/
│   │   ├── http_server.py # FastAPI dashboard + HTTP honeypot + auth
│   │   ├── ssh_server.py  # Paramiko SSH honeypot (50+ commands)
│   │   └── telnet_server.py # Asyncio Telnet honeypot
│   └── static/
│       └── index.html     # Premium single-page dashboard with login
├── tests/
│   ├── test_anomaly.py    # Anomaly detection tests
│   ├── test_auth.py       # Dashboard authentication tests
│   ├── test_db.py         # Database round-trip tests
│   ├── test_http_server.py # HTTP honeypot tests
│   ├── test_ratelimit.py  # Rate limiter tests
│   ├── test_ssh_server.py # 40+ SSH command tests
│   └── test_vfs.py        # 50+ VFS tests
├── docker-compose.yml     # PostgreSQL + BaitBox stack
├── Dockerfile
├── requirements.txt
└── README.md

BaitBox is intended for educational and research purposes only. Deploy only on isolated machines or behind a strict firewall. The maintainers are not responsible for any misuse or damage. Ensure you comply with all applicable laws in your jurisdiction.

MIT — see LICENSE for details.