🔧 Configuration & Setup
Download the repository and install dependencies.
git clone https://github.com/SecH0us3/honeypot.git
cd honeypot
npm iDeploy the worker to Cloudflare's edge network using Wrangler.
npx wrangler deployGo to your Cloudflare Dashboard and create an API Token. You will need the following permissions to manage IP Lists automatically:
Account : Account WAF : EditAccount : Account Filter Lists : EditZone : Zone : Read
Navigate to your worker's live URL (e.g., https://your-worker.workers.dev/install).
Paste your generated API token, your Zone ID, and select the behavior mode.
(Zone ID can be found
on the Overview page of your website in Cloudflare)
The worker will automatically create an IP List named honeypot_ips and
configure the WAF rule to block them.
🔄 Maintenance & Reinstallation
To re-run the setup flow (e.g., to update tokens or behavior) without clearing KV manually:
- Set a secret key via CLI:
npx wrangler secret put REINSTALL_KEY - Visit the protected install URL:
/install?reinstall=YOUR_SECRET_KEY
🎯 Purpose & Architecture
Detailed Overview
Modern web infrastructure is constantly probed by automated scanners, botnets, and script kiddies
searching for exposed .git directories, `.env` files, or vulnerable admin panels. This
Honeypot is designed to intercept these probes directly at the CDN Edge before they ever reach your
origin servers.
Instead of merely blocking the scanner, the Honeypot deceives it. It dynamically generates hyper-realistic fake responses—such as artificial Terraform state files, populated OpenAPI schemas, or convincing SQL dumps. This wastes the attacker's computational resources and provides rich telemetry on their attack patterns.
Key Mechanisms
- Active Defense Integration: When an attacker trips a wire, the Honeypot uses the
Cloudflare API to add their IP directly into an Account-level Custom List
(
honeypot_ips). - TTL Cleanup: A lightweight Cron trigger runs directly on the Worker, automatically purging IPs older than 3 hours to prevent list exhaustion and avoid permanent lockouts for dynamic IP addresses.
- Behavior Modes: Choose between "Ghost Mode" (returning empty 200/404 responses while secretly blocking the IP) or "Deception Mode" (serving dynamic fake payloads).
- Realistic Latency: In deception mode, artificial latency is injected. Random response delays mimic the time it would take a real backend server to generate an SQL dump or compress an archive.
Tech Stack
🧪 Demo Traps
Click endpoints to trigger simulated payloads in a preview window.