HTTP Admin Honeypot

Detect unauthorized access attempts targeting HTTP admin panels and dashboards.

About HTTP Admin

HTTP admin panels are web-based management interfaces for routers, application servers, databases, and monitoring tools — prime targets for attackers seeking administrative control over infrastructure.

The honeypot serves a convincing HTML login page, styled to match the interface an attacker is probing for — a WordPress wp-login.php, phpMyAdmin, Grafana, or a generic admin portal (chosen from the requested path). A browser or scanner sees a real-looking form, submits credentials, and is shown an "Invalid username or password" banner — while every attempt is captured. HTTP Basic Authentication is captured too, for tools that use it.

What Gets Captured

When an attacker interacts with your HTTP Admin honeypot, Tripwires captures:

• Username & password - from the submitted login form (WordPress log/pwd, phpMyAdmin pma_username, generic username/password, …) or the HTTP Basic Auth header
• Panel & path - which admin interface and URL was probed
• Source IP - The attacker's IP address
• Timestamp - Exact time of the request
• User-Agent - The browser or tool used to connect

Login-form POST

curl -d 'log=admin&pwd=hunter2' http://http-xxx.gettripwires.com:8080/wp-login.php

Connection Formats

HTTP Admin credentials can be planted in various formats depending on your tech stack:

Browser URL

http://user:password@http-xxx.gettripwires.com:8080/admin

curl with Basic Auth

curl -u user:password http://http-xxx.gettripwires.com:8080/admin

Python (requests)

import requests
response = requests.get(
    'http://http-xxx.gettripwires.com:8080/admin',
    auth=('user', 'password')
)

wget

wget --user=user --password=password http://http-xxx.gettripwires.com:8080/admin

Strategic Placement Ideas