ADBHoney
ADBHoney is a self-hosted, low-interaction honeypot for observing activity against Android Debug Bridge services exposed over TCP/IP.
What ADBHoney is
ADBHoney is a self-hosted, low-interaction honeypot for observing activity against Android Debug Bridge services exposed over TCP/IP. It is designed to catch malware pushed to exposed devices, including services on port 5555. The project accepts ADB connect, push, and shell operations; captured data is redirected to stdout, and uploaded files are saved to disk. Its simulated shell has a narrow response: `adb shell ls` gets a unique response, while other commands return `command not found`. Advanced commands such as native directory listing and an interactive shell are not supported. The configuration file, `adbhoney.cfg`, must be placed beside `run.py` or at `/etc/adbhoney.cfg`. The README describes running the Python script or building and running a Docker container, and says CPU and memory use should be fairly low. The repository identifies its license as GPL-3.0, and the GitHub profile identifies maintainer huuck as Gabriel Cirlig. For protocol behavior issues, the maintainer asks for a `.pcap` file or very exact reproduction steps.
Good
- Accepts ADB connect, push, and shell operations
- Saves uploaded files to disk
- Can run as a Python script or Docker container
- README describes CPU and memory use as fairly low
Watch out
- Other shell commands return `command not found`
- No interactive shell or native directory listing
- Configuration file must be in a specified location
Who it suits
ADBHoney is intended for people investigating activity against exposed Android Debug Bridge services. Its limited shell behavior suits observation rather than interactive ADB use.
Verdict
ADBHoney provides a narrow decoy for monitoring exposed ADB services and retaining uploaded files. Its command limitations make it unsuitable where a fuller interactive shell is needed.
The facts
Each one read from ADBHoney's own pages, with the date it was checked.
What it does
- ADB commands
- It supports connecting with adb connect, uploading with adb push, and running commands with adb shell.checked 8 Oct 2026
- Captured data
- Data is redirected to stdout and uploaded files are saved to disk.checked 4 Oct 2026
- Configuration
- The configuration file must be beside run.py or at /etc/adbhoney.cfg.checked 8 Oct 2026
- Deployment
- The project can be started with Python or run using Docker or Docker Compose.checked 8 Oct 2026
- Intended users
- The README describes the project for investigating activity against exposed Android Debug Bridge services.checked 8 Oct 2026
- Issue reports
- The maintainer asks for a .pcap or very exact reproduction steps when reporting protocol issues.checked 8 Oct 2026
- License
- The GitHub repository identifies the project as GPL-3.0 licensed.checked 8 Oct 2026
- Limitations
- More advanced commands, including native directory listing and an interactive shell, are not supported.checked 8 Oct 2026
- Logging
- Data is redirected to stdout, and files are saved to disk.checked 8 Oct 2026
- Protocol
- It accepts ADB connect, push, and shell operations.checked 4 Oct 2026
- Purpose
- ADBHoney is a low interaction honeypot designed for Android Debug Bridge over TCP/IP.checked 8 Oct 2026
- Resource use
- The README says CPU and memory usage should be fairly low.checked 8 Oct 2026
- Shell responses
- The adb shell ls command has a unique response; other commands respond with command not found unless responses are added in responses.py.checked 8 Oct 2026
- Support
- For issues involving protocol behavior, the maintainer asks for a `.pcap` or very exact reproduction steps.checked 4 Oct 2026
- Use case
- The project aims to catch malware pushed by attackers to devices with port 5555 exposed.checked 8 Oct 2026
The company
- Maker
- The GitHub profile identifies huuck as Gabriel Cirlig.checked 4 Oct 2026
Alternatives to ADBHoney
- 1
Canarytokens
Free planAndroidiOSWebSelf-hosted6.6Free plan - 2
OpenCanary
Free planLinuxmacOSSelf-hosted6.5Free plan - 3
Honeytrap
Free planLinuxSelf-hosted6.2Free plan - 4
KFSensor
Windows6.2From $120 a year - 5
Thinkst Canary
WebAPILinuxmacOS6.2From $7,500 a year - 6
Honeyd
Free planLinuxSelf-hostedWindows6.0Free plan