- Home
- Honeypot Software
- ADBHoney
ADBHoney
What it is
ADBHoney is a free, open-source, self-hosted honeypot for observing malware activity against Android Debug Bridge services exposed over TCP/IP. It is designed as a low-interaction endpoint decoy, including for devices with port 5555 exposed. The honeypot accepts ADB connect, push, and shell operations. Captured activity is sent to standard output, while uploaded files are written to disk. Its simulated shell is deliberately narrow: adb shell ls receives a unique response, and other commands return command not found. Native directory listing and an interactive shell are not supported. Configuration uses adbhoney.cfg, placed beside run.py or at /etc/adbhoney.cfg. The project documents running the Python script or building a Docker container, and says CPU and memory use should be fairly low. The repository uses GPL-3.0. For protocol issues, its maintainer requests a packet capture or exact reproduction steps.
For and against
For
- Free and open source under GPL-3.0
- Accepts ADB connect, push, and shell
- Saves uploaded files to disk
- Supports Python or Docker deployment
- Designed for exposed ADB investigation
Against
- Interactive shell is not supported
- Most shell commands return command not found
- Requires self-hosted deployment
- Configuration file location is required
The verdict
ADBHoney provides a narrow ADB decoy for capturing connections, commands, and uploaded files. Its limited shell behavior makes it suited to focused observation rather than a full Android debugging environment.
Who it suits
ADBHoney suits security practitioners investigating activity against exposed Android Debug Bridge services. It is intended for self-hosted deployments where a focused endpoint decoy is sufficient.
On the record
- ADB commands
- It supports connecting with adb connect, uploading with adb push, and running commands with adb shell.github.com · read 8 Oct 2026
- Captured data
- Data is redirected to stdout and uploaded files are saved to disk.github.com · read 4 Oct 2026
- Configuration
- The configuration file must be beside run.py or at /etc/adbhoney.cfg.github.com · read 8 Oct 2026
- Deployment
- The project can be started with Python or run using Docker or Docker Compose.github.com · read 8 Oct 2026
- Intended users
- The README describes the project for investigating activity against exposed Android Debug Bridge services.github.com · read 8 Oct 2026
- Issue reports
- The maintainer asks for a .pcap or very exact reproduction steps when reporting protocol issues.github.com · read 8 Oct 2026
- License
- The GitHub repository identifies the project as GPL-3.0 licensed.github.com · read 8 Oct 2026
- Limitations
- More advanced commands, including native directory listing and an interactive shell, are not supported.github.com · read 8 Oct 2026
- Logging
- Data is redirected to stdout, and files are saved to disk.github.com · read 8 Oct 2026
- Maker
- The GitHub profile identifies huuck as Gabriel Cirlig.github.com · read 4 Oct 2026
- Protocol
- It accepts ADB connect, push, and shell operations.github.com · read 4 Oct 2026
- Purpose
- ADBHoney is a low interaction honeypot designed for Android Debug Bridge over TCP/IP.github.com · read 8 Oct 2026
- Resource use
- The README says CPU and memory usage should be fairly low.github.com · read 8 Oct 2026
- Shell responses
- The adb shell ls command has a unique response; other commands respond with command not found unless responses are added in responses.py.github.com · read 8 Oct 2026
- Support
- For issues involving protocol behavior, the maintainer asks for a `.pcap` or very exact reproduction steps.github.com · read 4 Oct 2026
- Use case
- The project aims to catch malware pushed by attackers to devices with port 5555 exposed.github.com · read 8 Oct 2026
