╔═══════════════════════════════════════════════════════╗
║ 🩸 BLOOD-WEB HONEYPOT ║
╠═══════════════════════════════════════════════════════╣
║ ║
║ SSH · FTP · HTTP · Telnet · SMB · MySQL · RDP ║
║ ║
║ ┌─────────┐ ┌──────────┐ ┌──────────────┐ ║
║ │ attacker │───▶│ honeypot │───▶│ dashboard │ ║
║ └─────────┘ └──────────┘ └──────────────┘ ║
║ │ ║
║ ┌────▼────┐ ║
║ │ logs │ ║
║ └─────────┘ ║
╚═══════════════════════════════════════════════════════╝
Blood-Web is a modular, realistic honeypot designed for pentesting training and attack detection. It simulates 7 vulnerable services with fake filesystems, databases, and user accounts — all in a single Python file with zero dependencies.
Authorized use only. Run on your own infrastructure or isolated lab environments. See LEGAL.md.
| Feature | Description |
|---|---|
| 7 Services | SSH, FTP, HTTP, Telnet, SMB, MySQL, RDP |
| Web Dashboard | Real-time monitoring with dark theme UI |
| Structured Logs | Forensic-ready log files |
| Smart Detection | SQLi, XSS, brute force, path traversal, NTLM capture |
| Configurable | Custom ports, optional services |
| Zero Dependencies | Python 3.8+ only — no pip install needed |
# Clone
git clone https://github.com/s1d9e/blood-web.git
cd blood-web
# Run (non-privileged ports)
python3 blood-web.py
# With dashboard
python3 blood-web.py --web-monitor
# All services + dashboard (paranoid mode)
python3 blood-web.py --ssh --ftp --http --telnet --smb --mysql --rdp --web-monitor| Service | Default Port | Alt Port | Attacks Detected |
|---|---|---|---|
| SSH | 22 | 2222 | Brute force, username enum, key exchange |
| FTP | 21 | 2121 | Credentials, directory traversal, file access |
| HTTP | 80 | 8080 | SQLi, XSS, path traversal, dirbusting |
| Telnet | 23 | 2323 | Shell commands, nmap, metasploit |
| SMB | 445 | 4445 | NTLM auth, share enumeration, sensitive files |
| MySQL | 3306 | 33306 | SQL injection, enumeration, dumps |
| RDP | 3389 | 33890 | Username extraction, connection attempts |
Launch with --web-monitor and open http://localhost:8081:
┌─────────────────────────────────────────────────────────────┐
│ 🩸 BLOOD-WEB MONITOR │
├─────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ 247 │ │ 12 │ │ 45 │ │ 89 │ │
│ │ TOTAL │ │ CRITICAL │ │ HIGH │ │ MEDIUM │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
│ │
│ LIVE FEED: TOP ATTACKERS: │
│ ┌─────────────────────────┐ 185.220.101.34 89 │
│ │ 14:32:15 192.168.1.x │ 45.33.32.156 67 │
│ │ SQL_INJECTION │ 104.211.55.210 45 │
│ │───────────────────────│ 89.248.165.52 34 │
│ │ 14:32:10 10.0.0.5 │ │
│ │ SSH_BRUTE_FORCE │ BY SERVICE: │
│ │───────────────────────│ SSH ████████ 89 │
│ │ 14:31:58 172.16.0.x │ HTTP ██████ 67 │
│ │ FTP_TRAVERSAL │ FTP ████ 45 │
│ └─────────────────────────┘ SMB ██ 23 │
│ │
└─────────────────────────────────────────────────────────────┘
hydra -l admin -P rockyou.txt ssh://localhost:2222curl "http://localhost:8080/api/user?id=1' OR '1'='1"ftp localhost 2121
USER admin
PASS password123localhost:2323
login: admin
password: admin123
$ nmap -sV localhost
$ msfconsole
2026-04-03 14:32:15 | 192.168.1.100:54321 -> ssh | SSH_AUTH_BRUTE_FORCE | User: admin | Severity: HIGH
2026-04-03 14:32:10 | 10.0.0.5:44321 -> http | SQL_INJECTION | /api/user?id=1' OR 1=1 | Severity: CRITICAL
2026-04-03 14:31:58 | 172.16.0.20:52341 -> ftp | FTP_CREDENTIALS | admin:password123 | Severity: HIGH
blood-web/
├── blood-web.py # Main honeypot (1500+ lines)
├── web_monitor.py # Dashboard server
├── logs/ # Auto-generated attack logs
├── .assets/ # Logo and images
├── LICENSE # MIT
├── LEGAL.md # Legal disclaimer
└── README.md
- Fork the repo
- Create a feature branch (
git checkout -b feature/amazing) - Commit (
git commit -m 'Add amazing feature') - Push (
git push origin feature/amazing) - Open a Pull Request
MIT — see LICENSE.
"All that and a bag of chips..."
Made with 🩸 by s1d9e