July 25th, 2024

HellPot – A portal to endless suffering meant to punish unruly HTTP bots

HellPot is a honeypot that simulates a real website to deter non-compliant HTTP bots, utilizing a Markov engine and offering easy setup, logging, and performance optimization. It supports integration with Nginx and Apache.

Read original articleLink Icon
HellPot – A portal to endless suffering meant to punish unruly HTTP bots

HellPot is a honeypot designed to engage and deter non-compliant HTTP bots by providing an infinite stream of data that simulates a real website. It is built on the Heffalump framework and utilizes a Markov engine to generate content from Friedrich Nietzsche's "The Birth of Tragedy." The honeypot features a TOML configuration file for easy setup and customization, JSON logging for improved tracking and analysis, and is optimized for high performance to handle multiple connections.

To install HellPot, users can clone the repository from GitHub, navigate to the directory, and build it using Make. If no configuration file is present, a default one will be created in the user's home directory. Users can run the binary directly or configure it for more advanced setups. The configuration options include HTTP server settings, logging preferences, and performance tuning.

The repository also provides example configurations for integrating HellPot with Nginx and Apache as reverse proxies. Additionally, it mentions related projects, such as Pandora's Pot, which is inspired by HellPot and developed in Rust. For further details, users can visit the HellPot GitHub page.

Link Icon 9 comments
By @thepuppet33r - 6 months
I feel like this is cool, but is also a harbinger of how the Internet is becoming a bunch of bots trying to trick other bots away from the real content, which is how often being written by bots (at least in part).
By @alyandon - 6 months
I wrote a similar tool years ago to get better acquainted with Go. It was an endless procedurally generated website of linked pages that contained things that looked like email addresses along with username/password combinations.

The logs were fun to watch.

By @metadat - 6 months
Is there a demo site where we can see this in action?
By @cratermoon - 6 months
Years and YEARS ago Ronald F. Guilmette came up with wpoison, a CGI script that generated random web content containing made-up e-mail addresses. It existed to poison spammer's email address databases.

The spirit of that effort lives on in an improved version at https://gitlab.com/gloomytrousers/wpoison

By @OutOfHere - 6 months
I don't know why this is necessary. If a particular IP is hammering your site, it's sufficient to intelligently give HTTP 429 errors to encourage the IP to discipline and temper its requests. It works as well as anything else. If you don't want clients to access data, put it behind a login, not on the open internet.
By @axpvms - 6 months
There's also Lenny, the voice chatbot for wasting the time of telemarketers, scammers etc.

https://www.youtube.com/watch?v=HEmHTS2UGlc

By @surfingdino - 6 months
We need this to punish all those AI scrapers... I approve!
By @ChrisMarshallNY - 6 months
Sounds fun, but it also sounds like something they could learn, quickly.