The latest articles on DEV Community by hema omer (@h3ma209). https://dev.to/h3ma209 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4027229%2F69738fd3-c065-4a4e-9221-f71839195957.png https://dev.to/h3ma209 en hema omer Mon, 13 Jul 2026 12:08:47 +0000 https://dev.to/h3ma209/i-built-a-honeypot-that-wastes-hackers-time-instead-of-just-logging-them-3inj https://dev.to/h3ma209/i-built-a-honeypot-that-wastes-hackers-time-instead-of-just-logging-them-3inj <p>So I made krain-sec — a Go honeypot that pretends to be a fully functional corporate server, a full Krain Security ops console.</p> <p>Why I made this?</p> <p>Our servers have been getting hit by everything from script kiddies to above-average attackers. Firewalls and enterprise security solutions were expensive and a pain to maintain. </p> <p>So I built something lightweight, automated, and easy to deploy instead — for people who can't afford enterprise security products, usually small teams running their own infrastructure.</p> <p>What makes it different?</p> <p>Most honeypots out there are built to detect and log and usually block and manhunt the attacker. That's it. Krain-sec is built to waste attackers' time and irritate them — endless rabbit-holes, confuse scanners, dead ends that look like real progress.<br> What's in the box</p> <ul> <li><p>A login page and dashboard that look like the real ops tool</p></li> <li><p>A fake admin SSH box with old command history and "emergency" credential files lying around</p></li> <li><p>Bait files (canary-token style) that quietly phone home the second someone opens or exfils them</p></li> <li><p>A browser-side trick (think WebRTC/fingerprinting) that can leak an attacker's real network info when they load the fake dashboard — still refining how far to take this, open to feedback here</p></li> <li><p>A robots.txt / sitemap that basically says "don't look here" (so of course they look)</p></li> <li><p>A live board showing who's knocking, what's failing, and what they've touched</p></li> </ul> <p>The idea is simple: make them stay, dig, grab the wrong secrets, and burn time — while you watch.</p> <p>Scanners trip the forbidden paths. Humans loot the fake AWS keys. You watch it all light up on the dashboard.</p> <p>Running it<br> Set your env variables, then:<br> bashmake prod<br> That's it.</p> <p>Try it / contribute<br> Open source → <a href="//github.com/h3ma209/krain-sec">Krain-Sec</a><br> Lab / research only. Don't drop this onto a network you don't own, and this isn't meant for hacking back at anyone — just wasting their time and learning what they're after.</p> <p>More features are coming. If you run into issues, let me know.<br> If you've got deception ideas — DNS canaries, Office beacons, Endlessh on port 22 — drop them below. Building in public.</p> cybersecurity go security showdev