Honeypots | VirtualMetric

📄️ Domain Controller

Composing the DNS, Kerberos, LDAP, SMB, and WinRM honeypots into a single fake Active Directory Domain Controller.

Database honeypot emulating the MySQL, PostgreSQL, or SQL Server wire protocol to capture credentials and crackable hashes.

DNS honeypot that answers Active Directory DC-locator SRV queries to steer scanners toward the other honeypot listeners.

FTP honeypot that logs every authentication attempt in cleartext over an emulated control channel.

Kerberos honeypot emulating a KDC to capture usernames and requested service principals for enumeration and Kerberoasting detection.

LDAP honeypot that captures bind credentials and, under Domain Controller emulation, answers reconnaissance searches like a domain controller.

RDP honeypot that completes enough of the NLA handshake to capture crackable NTLM credentials, without ever serving a desktop.

SMB honeypot that captures NTLM authentication attempts and can emulate a Domain Controller with a browsable fake SYSVOL/NETLOGON tree.

SSH honeypot that logs every authentication attempt in cleartext and opens an emulated shell on a credential match.

Telnet honeypot that logs every authentication attempt in cleartext and opens an emulated shell on a credential match.

VNC honeypot emulating the RFB authentication handshake to capture crackable credential hashes.

WinRM honeypot that drives the HTTP NTLM/Basic authentication handshake to capture crackable and cleartext credentials.