FTP Honeypot Enterprise Community

The FTP module sends a configurable banner, accepts USER/PASS, logs credentials, and denies access.

Configuration

"ftp": [
  {
    "port": 2121,
    "banner": "Microsoft FTP Service"
  }
]

Parameters

Parameter	Type	Default	Description
port	integer	(required)	TCP port
banner	string	Microsoft FTP Service	Text after the 220 greeting

Banner examples

Microsoft FTP Service
(vsFTPd 3.0.3)
ProFTPD 1.3.6
FileZilla Server 1.6.7

What gets captured

Event	Fields
Connection made	Source IP and port
Data sent	Raw client commands
Login attempt	Username and password from USER/PASS