🕷️ App Reactive Honeypot (SNARE)

Dynamic web app honeypot generating convincing vuln responses.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A full web application honeypot that dynamically generates convincing responses to attacker probes. Unlike static honeypots, it analyzes the attacker's request (SQL injection, XSS, path traversal, LFI) and returns a tailored, realistic-looking "vulnerable" response that keeps the attacker engaged while capturing their full exploit chain.

Implementation requirements

SNARE (attack surface server) + TANNER (analysis engine) deployment
OR custom implementation using reverse proxy + response generation logic
Dynamic response templates for common exploit types (SQLi returns fake DB results, LFI returns fake /etc/passwd)
Full request/response logging with PCAP
Network isolation: Honeypot must NOT have access to real databases or filesystems
Consider deploying alongside real application on a separate subdomain (e.g., staging-legacy.yourapp.com)
Rollback: Shut down the honeypot and remove its DNS and routing.
Upkeep: Update its response templates and the software it imitates. Monthly proof-of-life probe.

Technologies

Application

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1059 Command and Scripting Interpreter	Execution	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — Attacker shell payloads (bash, base64-decoded scripts) were captured on the container honeypot. Cowrie — SSH and Telnet honeypot — Cowrie logs the shell commands an intruder runs on the SSH/Telnet honeypot.
T1190 Exploit Public-Facing Application	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) An Innovative Security Strategy using Reactive Web Application Honeypot — SNARE and TANNER, a reactive web-application honeypot that answers exploitation attempts. Deception in Dynamic Web Application Honeypots: Case of Glastopf — Glastopf, a web-application honeypot that replies to attacks with the responses attackers expect. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1190 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1190 Exploit Public-Facing Application as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1190 to its Lures activity.

Evidence

An Innovative Security Strategy using Reactive Web Application Honeypot — Gupta, R.; Viswanatham V., M.; Manikandan, K., arXiv 2021 peer-reviewed
Deception in Dynamic Web Application Honeypots: Case of Glastopf — Mphago, B., DOI 10.17781/P002304 2017 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Gupta et al., "An Innovative Security Strategy using Reactive Web Application Honeypot" (arXiv, 2021). Legacy: Glastopf (Honeynet Project). Current: SNARE + TANNER framework.