ADBHoney

What ADBHoney is

ADBHoney is a self-hosted, low-interaction honeypot for investigating activity directed at exposed Android Debug Bridge services. It is designed to catch malware pushed to devices over ADB on TCP/IP, including devices with port 5555 exposed. The decoy accepts ADB connection, file-upload, and shell operations, so it can record attempts to connect, push files, or issue commands. Captured data is redirected to standard output, while uploaded files are written to disk.

Its simulated shell is deliberately narrow: `adb shell ls` gets a distinct response, whereas other commands return `command not found`. Native directory listing and interactive shell sessions are outside its supported scope. Configuration comes from `adbhoney.cfg`, placed beside `run.py` or at `/etc/adbhoney.cfg`. The project README describes launching the Python script or building and running a Docker container, and characterizes CPU and memory use as fairly low. The repository identifies the software as GPL-3.0 open source. Its GitHub profile identifies huuck as Gabriel Cirlig. For protocol-behavior issues, the maintainer requests a `.pcap` capture or highly precise reproduction steps.

Who it suits

ADBHoney suits people investigating activity against exposed Android Debug Bridge services, especially attempts to push malware to reachable devices. It is for operators able to deploy a self-hosted endpoint decoy and work within its limited shell simulation.

Limits

The shell simulation gives a unique response only to `adb shell ls`; other commands return `command not found`. Native directory listing and interactive shell sessions are not supported.

Getting started

1. Open the ADBHoney GitHub project page.
2. Choose to run the Python script or build and run a Docker container.
3. Place `adbhoney.cfg` beside `run.py` or at `/etc/adbhoney.cfg`.
4. Run the deployment and observe captured data on stdout and uploaded files on disk.

Verdict

Choose ADBHoney to observe connection, upload, and command activity against exposed ADB endpoints with a focused honeypot. Look elsewhere if the task requires native directory listing, a broad set of shell commands, or interactive shell behavior.