MySQL Honeypot Enterprise Community

The MySQL service emulates a MySQL database server and captures login attempts.

Configuration

"mysql": [
  {
    "port": 3306,
    "version": "8.4.3",
    "auth_plugin": "mysql_native_password"
  }
]

Parameters

Parameter	Type	Default	Description
port	integer	3306	TCP port
version	string	8.4.3	Server version string in the handshake
auth_plugin	string	mysql_native_password	Auth plugin advertised to clients (mysql_native_password or mysql_clear_password)

Version examples

8.4.3
8.0.36
5.7.44
10.11.10-MariaDB

Set this to match the MySQL version running elsewhere in your environment.

What gets captured

Event	Fields
Connection made	Source IP and port
Data sent	Raw client packets
Login attempt	Username, hex-encoded password, optional auth packet details