Honeypot Detection

Overview

scan4all includes intelligent honeypot detection to avoid wasting time on deception systems and prevent potential blacklisting. The detection system analyzes HTTP server headers and response patterns to identify likely honeypots.

Honeypot detection is disabled by default. Enable it explicitly when scanning untrusted or unknown networks.

Enable Honeypot Detection

Environment Variable

# Enable honeypot detection
EnableHoneyportDetection=true ./scan4all -l targets.txt

# Disable (default)
EnableHoneyportDetection=false ./scan4all -l targets.txt

Configuration File

In config/config.json:

{
  "EnableHoneyportDetection": true
}

Detection Methods

Server Header Analysis

The primary detection method analyzes HTTP Server headers for anomalies:

func CheckHoneyportDetection4HeaderServer(server, szUrl string) bool {
    if 50 < len(server) || 3 < len(strings.Split(server, ",")) {
        // Suspicious: Very long server string or multiple components
        hdCache.Store(szUrl, true)
        SendLog(szUrl, "Honeypot found", "")
        return true
    }
    return false
}

Detection Criteria

A target is flagged as a honeypot if:

Server header exceeds 50 characters
Server header contains more than 3 comma-separated components
Unusual server identification patterns

Why These Indicators?

Honeypots often exhibit unusual characteristics:

Long Server Strings: Attempting to mimic multiple services
Multiple Components: Fake banner stacking
Inconsistent Responses: Conflicting service information

Legitimate servers typically have concise, consistent headers:

Server: nginx/1.20.1
Server: Apache/2.4.41
Server: Microsoft-IIS/10.0

Honeypot examples:

Server: Apache/2.4.1,nginx/1.19,Microsoft-IIS/8.0,Tomcat/9.0
Server: Very-Long-Custom-Server-Name-That-Attempts-To-Confuse-Scanners-And-Make-Them-Think-This-Is-Something-Special

Detection Workflow

Implementation Details

Memory Caching

Results are cached to avoid repeated checks:

var hdCache sync.Map  // Thread-safe cache

func HoneyportDetection(host string) bool {
    // Check cache first
    if v, ok := hdCache.Load(host); ok {
        return v.(bool)
    }
    
    // Perform detection
    isHoneypot := checkServer(host)
    
    // Cache result
    hdCache.Store(host, isHoneypot)
    
    return isHoneypot
}

HTTP HEAD Request

Minimal network footprint using HEAD requests:

timeout := time.Duration(8 * time.Second)
client := http.Client{
    Timeout: timeout,
    Transport: &http.Transport{
        TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
        DisableKeepAlives: true,
    },
    CheckRedirect: func(req *http.Request, via []*http.Request) error {
        return http.ErrUseLastResponse // Don't follow redirects
    },
}

resp, err := client.Head(target)

Target Filtering

Certain targets are automatically excluded:

if !EnableHoneyportDetection || len(host) < 5 || isIPCIDR(host) {
    return false  // Skip detection
}

Skipped:

Very short hostnames (likely invalid)
CIDR ranges (checked during host enumeration)
When detection is disabled

Integration Points

Port Scanner Integration

// From pkg/naabu/v2/pkg/runner/targets.go
if HoneyportDetection(target) {
    log.Println("Honeypot found, skipped for you:", target)
    continue  // Skip this target
}

Fingerprint Scanner Integration

func CheckHoneyport(fingerprints []string) (bool, []string) {
    isHoneypot := util.EnableHoneyportDetection && len(fingerprints) > 10
    if isHoneypot {
        fingerprints = []string{}  // Clear results
    }
    return isHoneypot, fingerprints
}

If more than 10 different fingerprints are detected on a single target, it’s flagged as suspicious and results are discarded.

Behavior

When Honeypot Detected

Log Entry: “Honeypot found, skipped for you: [target]”
Skip Scanning: Target removed from queue
Cache Result: Avoid re-checking same target
Continue: Move to next target

What Gets Skipped

Port scanning
Service detection
Vulnerability scanning
Fingerprinting
Exploitation attempts

Performance Impact

Network Overhead

# Per target:
# - 1 HTTP HEAD request (~200 bytes)
# - 8 second timeout
# - No impact if cached

# For 1000 targets:
# - First scan: ~1000 HEAD requests
# - Subsequent: 0 (cached)

Time Impact

Minimal delay:

Cached lookups: less than 1ms
HEAD request: ~100-500ms average
Timeout: 8 seconds maximum

Advanced Configuration

Customize Detection Logic

Edit lib/util/HoneypotDetection.go:

// Adjust detection thresholds
func CheckHoneyportDetection4HeaderServer(server, szUrl string) bool {
    // More aggressive: shorter threshold
    if 30 < len(server) || 2 < len(strings.Split(server, ",")) {
        return true
    }
    
    // Additional checks
    if strings.Contains(server, "honeypot") {
        return true
    }
    
    return false
}

Custom Fingerprint Threshold

var Max_Count = 10  // Maximum fingerprints before flagging

// In config or code:
Max_Count = 5  // More aggressive
Max_Count = 20 // More permissive

Logging

Honeypot detections are logged:

SendLog(szUrl, string(Scan4all), "Honeypot found", "")

Logs include:

Target URL
Detection source (scan4all)
Detection message
Timestamp

False Positives

Common Causes

Load Balancers: May aggregate multiple server headers
WAF/Proxy: Security appliances add headers
Misconfigured Servers: Poor administration

Handling False Positives

# Disable detection if too many false positives
EnableHoneyportDetection=false ./scan4all -l targets.txt

# Or adjust thresholds in source code

False Negatives

Sophisticated Honeypots

Some honeypots may evade detection:

Perfectly mimicked server headers
Realistic response patterns
Professional implementation

No honeypot detection is 100% accurate. This feature reduces false targets but doesn’t guarantee complete avoidance.

Best Practices

Enable for Unknown Networks: Always enable when scanning unfamiliar targets
Monitor Logs: Review detected honeypots for patterns
Adjust Thresholds: Tune based on your environment
Combine with Other Intel: Use alongside passive reconnaissance
Regular Updates: Keep detection logic current with honeypot trends

Use Cases

Bug Bounty Hunting

# Avoid wasting time on security research honeypots
EnableHoneyportDetection=true ./scan4all -l scope.txt

Red Team Operations

# Avoid detection and blacklisting
EnableHoneyportDetection=true ./scan4all -host target.com

Mass Scanning

# Filter honeypots from large internet scans
EnableHoneyportDetection=true ./scan4all -l ips.txt

Penetration Testing

# Usually disabled for client networks
EnableHoneyportDetection=false ./scan4all -l client_targets.txt

Troubleshooting

Detection Not Working

# Verify it's enabled
echo $EnableHoneyportDetection

# Check configuration
cat config/config.json | grep EnableHoneyport

# Enable explicitly
export EnableHoneyportDetection=true

Too Many Detections

# Adjust thresholds in source
# Or disable if environment has many load balancers
EnableHoneyportDetection=false ./scan4all -l targets.txt

Cache Issues

// Clear cache by restarting scan4all
// Cache is in-memory only

Comparison with Other Tools

Feature	scan4all	Other Scanners
Auto Detection	Yes (optional)	Usually No
Server Analysis	Yes	Limited
Fingerprint Count	Yes	No
Caching	Yes	Varies
Configurable	Yes	Limited

Advanced Topics

Development

Best Practices

​Overview

​Enable Honeypot Detection

​Environment Variable

​Configuration File

​Detection Methods

​Server Header Analysis

Detection Criteria

​Why These Indicators?

​Detection Workflow

​Implementation Details

​Memory Caching

​HTTP HEAD Request

​Target Filtering

​Integration Points

​Port Scanner Integration

​Fingerprint Scanner Integration

​Behavior

​When Honeypot Detected

​What Gets Skipped

​Performance Impact

​Network Overhead

​Time Impact

​Advanced Configuration

​Customize Detection Logic

​Custom Fingerprint Threshold

​Logging

​False Positives

​Common Causes

​Handling False Positives

​False Negatives

​Sophisticated Honeypots

​Best Practices

​Use Cases

​Bug Bounty Hunting

​Red Team Operations

​Mass Scanning

​Penetration Testing

​Troubleshooting

​Detection Not Working

​Too Many Detections

​Cache Issues

​Comparison with Other Tools

​See Also

Build docs developers (and LLMs) love

Overview

Enable Honeypot Detection

Environment Variable

Configuration File

Detection Methods

Server Header Analysis

Why These Indicators?

Detection Workflow

Implementation Details

Memory Caching

HTTP HEAD Request

Target Filtering

Integration Points

Port Scanner Integration

Fingerprint Scanner Integration

Behavior

When Honeypot Detected

What Gets Skipped

Performance Impact

Network Overhead

Time Impact

Advanced Configuration

Customize Detection Logic

Custom Fingerprint Threshold

Logging

False Positives

Common Causes

Handling False Positives

False Negatives

Sophisticated Honeypots

Best Practices

Use Cases

Bug Bounty Hunting

Red Team Operations

Mass Scanning

Penetration Testing

Troubleshooting

Detection Not Working

Too Many Detections

Cache Issues

Comparison with Other Tools

See Also