BlessedRebuS/Krawl

What it solves

Krawl is a cloud-native deception server (honeypot) designed to detect, delay, and analyze malicious attackers, automated scanners, and web crawlers. It helps security teams distinguish between legitimate traffic and malicious actors by creating a fake, vulnerable-looking attack surface that wastes attacker resources.

How it works

Krawl deploys realistic fake web applications containing "low-hanging fruit" like fake admin panels, configuration files, and exposed credentials. It uses several techniques to trap and analyze visitors:

• Deception Pages: Serves fake login pages (e.g., WordPress, phpMyAdmin) and AI-generated pages to lure attackers.
• Spider Traps: Creates infinite loops of random links to exhaust crawler resources.
• Tarpitting: Slows down responses for AI agents and malicious IPs to waste their time.
• Canary Tokens: Integrates with external alert systems to trigger notifications when specific bait is accessed.
• Analysis Tools: Uses TLSH fuzzy hashing to group similar attack payloads into campaigns and provides a real-time dashboard for geolocation, IP reputation, and behavioral analysis.

Who it’s for

Security researchers, system administrators, and DevOps engineers who want to shield their real services from scanners and gather threat intelligence on attackers.

Highlights

• AI-Generated Deception: Ability to let attackers help generate the fake attack surface.
• Comprehensive Dashboard: Includes an interactive map of IP origins, attack type breakdowns (SQLi, XSS, etc.), and forensic IP insights.
• Scalable Architecture: Supports both a lightweight standalone mode (SQLite) and a production-ready scalable mode (PostgreSQL and Redis).
• Federated Banlists: Allows multiple Krawl instances to share and merge IP banlists to preemptively block known threats.
• Kubernetes Ready: Provides native manifests and Helm charts for easy cloud deployment.