🗺️ Source Map Honeypot

Misleading JS source maps detecting reverse engineering.

→ Explore in ATT&CK matrix (1 mappings) Deployment detail

What it is

Deploy JavaScript source maps (.map files) that are not linked from the minified JS bundles but exist at predictable URLs. Any request to app.bundle.js.map is an attacker performing reverse engineering (legitimate users never request source maps). The source maps can contain: - Real-looking but misleading function names and file paths - Embedded honeytokens in fake "internal API" references - Breadcrumbs pointing to honey API routes (D074)

Implementation requirements

Webpack/Vite/Rollup build configuration with hidden-source-map (generates maps but doesn't link them)
Web server configured to serve .map files but log ALL access
Source map content: mix of real structure (for believability) with injected fake paths
Monitoring: Web server access logs filtered for *.map requests
OPSEC: Source maps must look realistic enough that the attacker doesn't realize they're being fed disinformation
Rollback: Delete the map files from the web server and clear them from any CDN cache.
Upkeep: Regenerate them when the bundle changes, so they look current. Monthly proof-of-life request.

Technologies

Application

ATT&CK coverage 1

Technique	Tactic	Status	Confidence	Tier
T1190 Exploit Public-Facing Application	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) An Innovative Security Strategy using Reactive Web Application Honeypot — SNARE and TANNER, a reactive web-application honeypot that answers exploitation attempts. Deception in Dynamic Web Application Honeypots: Case of Glastopf — Glastopf, a web-application honeypot that replies to attacks with the responses attackers expect. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1190 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1190 Exploit Public-Facing Application as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1190 to its Lures activity.

Evidence

Deception in Dynamic Web Application Honeypots: Case of Glastopf — Mphago, B., DOI 10.17781/P002304 2017 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Mphago et al., "Deception in Dynamic Web Application Honeypots" (ISSA, 2017). Webpack hidden-source-map configuration.