Mirage.
High-interaction honeypot that lures attackers into a believable emulated Ubuntu host without ever executing their input, then turns each captured session into an ATT&CK-mapped attacker dossier in a real-time threat-intel console.
Mirage is a high-interaction SSH and HTTP honeypot that lets attackers in, emulates a believable production Ubuntu host down to its filesystem and process table, and never executes a single thing they type. Every captured session is enriched and turned into an ATT&CK-mapped attacker dossier, complete with extracted IOCs, a sophistication score, and an inferred intent, all explorable in a real-time threat-intelligence console with terminal-style replay.
The system is split into two isolated planes. The capture plane runs the sensors and is treated as fully untrusted: it can only push events through a single token-authenticated /ingest endpoint and has no route back into the database or analysis logic. The docker-compose topology enforces this at the network layer, placing the sensors on a capture network with no path to the analysis internals beyond ingest. The analysis plane owns an append-only event store, the heuristic intelligence engine, the REST API, and the dashboard. This is a genuine threat-model decision, not cosmetic structure, and it means a compromise of the exposed surface cannot reach the collected intelligence.
The high-interaction core is a per-session virtual shell that maintains in-memory system state, a fake filesystem, users, environment, and a process table, and answers over fifty common commands with internally consistent output derived from that state. Command chains, pipelines into consuming sinks like crontab or tee, quoting, path resolution, and backspace and Ctrl-C handling are all modeled so the session feels real to both humans and bots, including the non-interactive ssh host 'cmd' form. Crucially nothing is ever run on the host: downloads are narrated and recorded as IOCs, dropped binaries return silently like a backgrounded payload, and unknown commands optionally fall through to a free local Ollama model for improvised output, defaulting to deterministic responses when no model is configured.
Intelligence is produced by a deterministic, SOC-style detection ruleset rather than a paid API. Twenty-three ATT&CK techniques across the full tactic chain are matched from shell behavior and web probes, with separate rule sets so traversal patterns do not false-positive on ordinary shell navigation. IOCs are pulled by pattern (URLs, IPv4, MD5 and SHA-256 hashes, dropped filenames, long base64 blobs), a sophistication score is computed from engagement, technique breadth, severity, obfuscation and persistence signals, and intent is inferred from the observed tactic mix. Captured credentials, reverse-DNS enrichment, and offline threat tagging round out each dossier.
The whole backend runs on native Node with no build step: TypeScript executes directly under Node 22.6, storage is the built-in node:sqlite with a relational schema that mirrors a Postgres target, and the entire capture and analysis backend pulls in just two runtime dependencies, express and ssh2. The dashboard is a React and Vite SPA streamed live over Server-Sent Events, with terminal session replay, an ATT&CK coverage matrix, and exports in CSV, STIX-lite, MITRE ATT&CK Navigator layer, and per-session JSON formats. When no React build is present the server falls back to a zero-build vanilla dashboard, so a fresh clone is runnable in one command.