79
A honeypot that binds to a large range of dummy TCP and UDP ports to frustrate network fingerprinting. (lemmy.world)
submitted 1 week ago* (last edited 6 days ago) by umutcamliyurt@lemmy.world to c/cybersecurity@sh.itjust.works
20 comments fedilink hide all child comments

Source code and details: https://github.com/umutcamliyurt/PortTripper

How it works

On startup PortTripper:

  1. Scans the configured port range and builds a whitelist of ports already in use by real services (first run only).
  2. Draws a cryptographically random sample of up to -maxports ports from the range, excluding whitelisted ports. Using crypto/rand for selection means the open set is unpredictable to an attacker even if they know the configured range.
  3. Binds TCP and UDP listeners on every chosen port.
  4. On TCP: accepts connections, holds them open for a configurable duration, then drops them, wasting the scanner's threads and file descriptors.
  5. On UDP: reads and discards datagrams without replying, so ports appear open|filtered to scanners rather than closed.

All real service ports are untouched because they are already bound before PortTripper starts, and the auto-generated whitelist tells PortTripper to skip them.

you are viewing a single comment's thread
view the rest of the comments
[-] atzanteol@sh.itjust.works 1 points 6 days ago

But with a reverse proxy, you’re only opening ports 80 and 443. Those are basically useless for an attacker, because it only tells them that you’re running something on http and https. And that could be anything.

That you seem to think a reverse proxy provides some sort of security is a bit... Terrifying.

[-] mic_check_one_two@lemmy.dbzer0.com 1 points 6 days ago

Nope, it just encrypts your traffic with https to avoid MITM attacks, and allows you to avoid opening more than two ports on your WAN. But if you simply open ports for every service, that’s usually a big easy “I’m running {service}” beacon. If I scan your WAN IP and find port 32400 open, I can make a reasonably safe bet that you’re running plex. But ports 80 and 443 won’t tell me anything about which services you’re running, because those are reserved for http and https traffic specifically. So I’d know that you’re running something, but I wouldn’t simply be able to guess which services specifically.

Sure, this listed honeypot may be able to help with that by making it appear as if every port is in use. But again, a reverse proxy would accomplish the same thing (without exposing all of your services directly) by simply shrouding all of your services behind 80 and 443.

this post was submitted on 30 May 2026
79 points (100.0% liked)

Cybersecurity

10060 readers
21 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 3 years ago
MODERATORS
kid@sh.itjust.works
Lanky_Pomegranate530@midwest.social