A simple RDP honeypot designed to attract, analyze, and inspect RDP-based attacks, developed in C#.
- Performs basic protocol mocking to distinguish RDP clients/exploits from port scanners.
- Automatically applies bans to IP addresses previously logged in the database as RDP exploiters. Port scanners are still allowed.
- Built with .NET 8 and C#, ensuring a robust and modern development foundation.
- Stores IP addresses, timestamps, and connection types in a SQLite database for detailed analysis.
- .NET 8.0 SDK
- Clone: Obtain the code from this repository.
- Customize: Adjust the configuration as needed.
- Build: Use Visual Studio to compile and prepare the honeypot.