🛤️ Honey API Route

Hidden API endpoints that trip on directory brute-forcing.

→ Explore in ATT&CK matrix (3 mappings) Deployment detail

What it is

Undocumented API endpoints embedded in the application that are never called by legitimate frontend code or automated tests. Examples: /api/v1/admin/debug, /internal/backup-export, /api/v1/users/bulk-download, /.well-known/admin. Any request to these endpoints is either directory brute-forcing (Gobuster, ffuf), code review of stolen source, or AI agent exploration.

Implementation requirements

Web framework route registration (Express.js, Flask, Spring Boot, etc.)
Route handler that: logs full request (IP, headers, body, auth token), returns a realistic-looking response (not 404 — a 200 with fake data is more deceptive), and triggers SIEM alert
OPSEC: Routes must NOT appear in OpenAPI/Swagger docs, frontend code, or automated test suites
Must return realistic response times (not instant — add artificial latency matching real endpoints)
Consider adding fake pagination to keep attacker engaged longer
Rollback: Remove the route and its monitoring rule from the application.
Upkeep: Keep it in the deployment pipeline so a release does not drop it. Monthly proof-of-life request.

Example

// DOAR-D074: Honey API Route — never called by legitimate code
app.get('/api/v1/admin/export-users', (req, res) => {
  doar.alert('D074', { ip: req.ip, headers: req.headers, auth: req.get('Authorization') });
  res.json({ users: generateFakeUserList(50), next_page: '/api/v1/admin/export-users?page=2' });
});

Illustrative only — names and paths shown here should never be deployed verbatim. Published decoy names become attacker IOCs.

Technologies

Application

ATT&CK coverage 3

Technique	Tactic	Status	Confidence	Tier
T1046 Network Service Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1046 to its Lures activity. Koney: A Cyber Deception Orchestration Framework for Kubernetes — (D029) Koney uses service meshes and eBPF to add traps to containerised applications; probing a trap is logged.
T1491 Defacement	Impact	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1491 Defacement as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1491 to its Lures activity. Defacing decoy routes needs write access that would already have alerted.
T1190 Exploit Public-Facing Application	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) An Innovative Security Strategy using Reactive Web Application Honeypot — SNARE and TANNER, a reactive web-application honeypot that answers exploitation attempts. Deception in Dynamic Web Application Honeypots: Case of Glastopf — Glastopf, a web-application honeypot that replies to attacks with the responses attackers expect. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1190 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1190 Exploit Public-Facing Application as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1190 to its Lures activity.

Evidence

Application Layer Cyber Deception without Developer Interaction — Kahlhofer, M.; Rass, S., ADnD 2024 (arXiv:2405.12852) 2024 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Kahlhofer et al., "Application Layer Cyber Deception without Developer Interaction" (arXiv, 2024)