live-attack-map

KO | EN

gitlite — search

#markdown #editor #python #command-line #awesome-list #llm #terminal #anthropic #agents #containers

live-attack-map

(★ 9)

No description available.

File Explorer

ZIP Download

- - ci.yml
- - index.html
- __init__.py
- app.py
- geo.py
- __init__.py
- server.py
- grafana-datasources.yml
- prometheus.yml
- promtail-config.yml
- test_app.py
- test_geo.py
- test_honeypot.py
- seed.py
.dockerignore
.gitignore
CHANGELOG.md
CONTRIBUTING.md
docker-compose.monitoring.yml
docker-compose.yml
Dockerfile
LICENSE
Makefile
pyproject.toml
README.md
requirements.txt
SECURITY.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

# Project Badges

CI Visit
License: MIT Visit
Python 3.10+ Visit
Docker Visit
PRs Welcome Visit

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

> A fake SSH honeypot that logs **real** brute-force attempts from the internet
> and streams them to a **real-time animated world map** dashboard.

## ✨ Features

- **Real SSH handshake** — speaks the genuine SSH protocol (paramiko), so real
  scanners and botnets treat it like any other server
- **Credential harvesting** — every username/password attempt is captured to a JSON log
- **Live geolocation** — attacker IPs mapped to countries (ip-api, cached)
- **Real-time dashboard** — WebSocket streaming with animated attack lines
- **Statistics panel** — top countries, usernames, passwords, attacks per minute
- **Demo mode** — seed realistic traffic instantly for testing and screenshots
- **One-command deploy** — `docker compose up`

## 🏗️ Architecture

## 🚀 Quick Start

### Docker (fastest — one command)

```bash
git clone https://github.com/Abolfazlrwm/live-attack-map.git && cd live-attack-map && docker compose up --build
```

Then open **http://localhost:8080**.

### Manual — Windows (PowerShell)

```powershell
git clone https://github.com/Abolfazlrwm/live-attack-map.git
cd live-attack-map
python -m venv .venv
.\.venv\Scripts\Activate.ps1
pip install -r requirements.txt
Start-Process python -ArgumentList "-m","honeypot.server","--port","2222"
Start-Process python -ArgumentList "-m","dashboard.app"
Start-Sleep -Seconds 2
python tools/seed.py --count 60
```

### Manual — Linux / macOS

```bash
git clone https://github.com/Abolfazlrwm/live-attack-map.git
cd live-attack-map
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python -m honeypot.server --port 2222 &
python -m dashboard.app &
python tools/seed.py --count 60
```

Then open **http://localhost:8080** — the map fills with animated attacks from cities all over the world within seconds.

### Run the tests

```bash
pip install pytest ruff && ruff check . && pytest -v
```

Expected result: `5 passed` ✅

## ⚙️ Configuration

Set these as environment variables:

| Variable       | Default              | Description               |
|----------------|-----------------------|----------------------------|
| `PORT`         | `8080`                | Dashboard port             |
| `LOG_PATH`     | `logs/attacks.jsonl`  | Shared attack log file     |
| `TARGET_LAT`   | `35.6892`             | Map target marker latitude |
| `TARGET_LON`   | `51.3890`             | Map target marker longitude|
| `TARGET_LABEL` | `Honeypot`            | Target marker label        |
| `SECRET_KEY`   | `change-me`           | Flask session secret — **set a real random value in production** |

Example:

```bash
TARGET_LAT=48.8566 TARGET_LON=2.3522 TARGET_LABEL=Paris python -m dashboard.app
```

## 📁 Project Structure

```text
live-attack-map/
├── .github/workflows/ci.yml   # CI: lint + tests (GitHub Actions)
├── honeypot/                  # Fake SSH server (paramiko)
│   └── server.py
├── dashboard/                 # Flask + SocketIO backend
│   ├── app.py                 # Web server + WebSocket streaming
│   ├── geo.py                 # IP geolocation (ip-api, cached)
│   └── templates/index.html   # Leaflet map + stats panel
├── tools/
│   └── seed.py                # Demo attack generator
├── tests/                     # pytest suite
├── Dockerfile
├── docker-compose.yml
├── Makefile
└── pyproject.toml
```

## 🛠️ Tech Stack

- **Python 3.10+** — Flask, Flask-SocketIO, Paramiko, Requests
- **Leaflet.js** — interactive dark world map
- **WebSocket (Socket.IO)** — real-time event streaming
- **Docker & docker-compose** — containerized deployment
- **GitHub Actions** — automated lint + test pipeline

## ⚠️ Responsible Use

This is a defensive security / threat intelligence tool. Run it only on infrastructure you own. The honeypot never grants access — it only observes and logs. Attack data may contain IPs of innocent parties; use it ethically and anonymize before sharing.

## 🗺️ Roadmap

- [ ] Telegram / email alerting on new attacks
- [ ] CSV / JSON export of attack data
- [ ] Additional fake services (HTTP, FTP, Telnet)
- [ ] Attack origin heatmap (time-of-day analysis)
- [ ] Login attempt timeline chart

## 🤝 Contributing

Contributions are welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines, and please run `ruff check .` and `pytest -v` before opening a PR.

## 📄 License

live-attack-map

Owner Repos

File Explorer

# Use via CDN

# Project Badges

Was this content helpful?

Recent Feedback

live-attack-map

Owner Repos

File Explorer

# Use via CDN

# Project Badges

Was this content helpful?

Recent Feedback

Download README