The latest articles on DEV Community by Patrick Di Fazio (@patrick_difazio_fe683f93). https://dev.to/patrick_difazio_fe683f93 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3712421%2Ff23c55dd-b2a3-4052-a5d2-d3855b7f805a.png https://dev.to/patrick_difazio_fe683f93 en Patrick Di Fazio Thu, 15 Jan 2026 15:23:57 +0000 https://dev.to/patrick_difazio_fe683f93/krawl-a-modern-honeypot-and-deception-server-i-wanted-to-share-an-open-source-project-ive-4c2m https://dev.to/patrick_difazio_fe683f93/krawl-a-modern-honeypot-and-deception-server-i-wanted-to-share-an-open-source-project-ive-4c2m <div class="crayons-card c-embed text-styles text-styles--secondary"> <div class="c-embed__content"> <div class="c-embed__cover"> <a href="https://github.com/BlessedRebuS/Krawl" class="c-link align-middle" rel="noopener noreferrer"> <img alt="" src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Frepository-images.githubusercontent.com%2F1113893223%2F9e545c59-d956-4ebf-ae31-34762a51b393" height="500" class="m-0" width="1300"> </a> </div> <div class="c-embed__body"> <h2 class="fs-xl lh-tight"> <a href="https://github.com/BlessedRebuS/Krawl" rel="noopener noreferrer" class="c-link"> GitHub - BlessedRebuS/Krawl: Krawl is a lightweight cloud native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities and realistic, randomly generated decoy data </a> </h2> <p class="truncate-at-3"> Krawl is a lightweight cloud native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities and realistic, randomly generated decoy data - BlessedR... </p> <div class="color-secondary fs-s flex items-center"> <img alt="favicon" class="c-embed__favicon m-0 mr-2 radius-0" src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fgithub.githubassets.com%2Ffavicons%2Ffavicon.svg" width="32" height="32"> github.com </div> </div> </div> </div> Patrick Di Fazio Thu, 15 Jan 2026 15:20:41 +0000 https://dev.to/patrick_difazio_fe683f93/-3pdj https://dev.to/patrick_difazio_fe683f93/-3pdj <div class="ltag__link"> <a href="/patrick_difazio_fe683f93" class="ltag__link__link"> <div class="ltag__link__pic"> <img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3712421%2Ff23c55dd-b2a3-4052-a5d2-d3855b7f805a.png" alt="patrick_difazio_fe683f93"> </div> </a> <a href="https://dev.to/patrick_difazio_fe683f93/krawl-a-modern-honeypot-and-deception-server-bfe" class="ltag__link__link"> <div class="ltag__link__content"> <h2>Krawl: A modern Honeypot and Deception server 🍯</h2> <h3>Patrick Di Fazio ・ Jan 15</h3> <div class="ltag__link__taglist"> <span class="ltag__link__tag">#security</span> <span class="ltag__link__tag">#selfhosted</span> <span class="ltag__link__tag">#opensource</span> <span class="ltag__link__tag">#webdev</span> </div> </div> </a> </div> security selfhosted opensource webdev Patrick Di Fazio Thu, 15 Jan 2026 13:26:09 +0000 https://dev.to/patrick_difazio_fe683f93/krawl-a-modern-honeypot-and-deception-server-bfe https://dev.to/patrick_difazio_fe683f93/krawl-a-modern-honeypot-and-deception-server-bfe <p>I wanted to share an open‑source project I’ve been working on and get feedback from people interested in web security, self‑hosting, and deception techniques :)</p> <p>GitHub repository:<br> <a href="https://github.com/BlessedRebuS/Krawl" rel="noopener noreferrer">https://github.com/BlessedRebuS/Krawl</a></p> <h2> What is Krawl? </h2> <p>Krawl is a cloud‑native deception server designed to detect, delay, and analyze malicious web crawlers and automated scanners.</p> <p>It exposes realistic fake web applications populated with common “low‑hanging fruit” such as admin panels, configuration files, and exposed (fake) credentials. These decoys attract suspicious activity and make it easier to clearly distinguish malicious behavior from legitimate crawlers.</p> <p>By intentionally wasting attacker resources, Krawl helps surface useful signals such as attack paths, IP addresses, and user agents.</p> <h2> Demo and Project </h2> <p>You can see a demo here:</p> <p><a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fprql9grs8ayg8ycbray8.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fprql9grs8ayg8ycbray8.png" alt=" " width="800" height="535"></a></p> <p>Live demo:<br> <a href="http://demo.krawlme.com" rel="noopener noreferrer">http://demo.krawlme.com</a></p> <p>Dashboard:<br> <a href="http://demo.krawlme.com/das_dashboard" rel="noopener noreferrer">http://demo.krawlme.com/das_dashboard</a></p> <h2> Key Features </h2> <ul> <li>Spider trap pages with infinite random links to exhaust automated crawlers</li> <li>Fake login pages including WordPress, phpMyAdmin, and generic admin panels</li> <li>Honeypot paths advertised via <code>robots.txt</code> to attract scanners</li> <li>Realistic fake credentials and secrets</li> <li>Optional canary token integration for external alerting</li> <li>Real‑time dashboard for monitoring suspicious activity</li> <li>JSON‑based wordlists for easy customization</li> <li>Random error injection to mimic real server misconfigurations</li> </ul> <h2> Real‑World Results </h2> <p>We've been running a self‑hosted instance of Krawl in a homelab for about two weeks, and the results have been interesting:</p> <ul> <li>A very clear separation between legitimate crawlers (such as Meta and Amazon) and malicious scanners</li> <li>Over 350,000 total requests logged</li> <li>Many attempts to access sensitive or deceptive paths</li> </ul> <p>The goal is to make deception realistic enough to fool automated tools, while remaining useful for defenders and researchers who want to detect and blacklist malicious actors.</p> <p>If you’re interested in honeypots, web security, or deception‑based defense, I’d love to hear your thoughts or see you contribute :)</p> security selfhosted opensource webdev