Knock-Knock: Watch the Bots Try to Break In

Live demo: https://knock-knock.net  |  Live tutorial: https://knock-knock.net/summary Knock-Knock is a multi-protocol honeypot with a live, animated attack dashboard, built-in support for the common internet protocols, an extensible architecture for adding your own, and a threat-intelligence database that powers a public IP blocklist feed. Watch the bots trying to break into unprotected Internet servers, in this information-packed dashboard! Discover the most frequent countries of origin! Be shocked by the most common usernames and passwords! Scoff at and ridicule the worst offending ISPs and IPs! Find out why the bots are choosing these usernames and passwords! Knock-Knock: Watch the Bots Try to Break In is the open-source project djkurlander/knock-knock (https://github.com/djkurlander/knock-knock) by djkurlander, released under MIT. Ion packages it unmodified from commit da33d6ae4a60, adding only a manifest, an icon and a start script.

Written by djkurlander, published to Oikou by Ben Grande.

• ★ 209 stars on GitHub
• Licence: MIT
• Upstream version v3.0.0
• Built from commit da33d6ae4a60

View the repository on GitHub

Not rated. Nobody has said who this app is suitable for, so Personal Clouds and the Oikou app treat it as 18+.

Internet

It asks to reach these hosts, and no others:

• www.abuseipdb.com
• unpkg.com
• cdn.jsdelivr.net
• fonts.googleapis.com
• fonts.gstatic.com

Ports of your Personal Cloud’s computer

Can accept connections from other machines on ports of your Personal Cloud’s computer you choose (TCP 21, TCP 22, TCP 23, TCP 25, TCP 102, UDP 161, TCP 445, TCP 502, TCP 587, TCP 1883, TCP 3389, TCP and UDP 5060, TCP 5061), and sees who connects: Records the break-in attempts on its SSH, Telnet, FTP, SMTP, RDP, SMB, SIP and other honeypots, from who made them

• TCP 21: An FTP honeypot that records who connects and what they try (ftp)
• TCP 22: An SSH honeypot that records who connects and what they try (ssh)
• TCP 23: A Telnet honeypot that records who connects and what they try (telnet)
• TCP 25: An SMTP honeypot that records who connects and what they try (smtp)
• TCP 102: A Siemens S7 honeypot that records who connects and what they try (s7)
• UDP 161: An SNMP honeypot that records who connects and what they try (snmp)
• TCP 445: An SMB honeypot that records who connects and what they try (smb)
• TCP 502: A Modbus honeypot that records who connects and what they try (modbus)
• TCP 587: An SMTP submission honeypot that records who connects and what they try (submission)
• TCP 1883: An MQTT honeypot that records who connects and what they try (mqtt)
• TCP 3389: An RDP honeypot that records who connects and what they try (rdp)
• TCP and UDP 5060: A SIP honeypot that records who connects and what they try (sip)
• TCP 5061: A SIP over TLS honeypot that records who connects and what they try (sips)

You choose the port of your Personal Cloud’s computer each one is reached on, and who may connect: your networks and tailnet, or anyone on the internet. Anyone who reaches one reaches the app’s server, and the app sees the address they connect from. A port open to the internet needs a port forwarded on your router: a Cloudflare Tunnel carries web traffic only.

Personal Cloud tools

• Run a Redis server of its own on your Personal Cloud (for its task queue and cache) ion.redis

Notifications

It does not send push notifications.

Storage

Up to 1 GB on your Personal Cloud.

Its address

Works best with its own address. A Personal Cloud shared through Cloudflare can give it one; on a private Personal Cloud on Tailscale it opens under your Personal Cloud’s address, where it may not work fully. Private and shared Personal Clouds

Sign in to add this web app to a Personal Cloud of yours. It runs there, on your own computer, and you open it from there; nothing is installed on your phone.

Sign in to add