The scanner finds it
An exposed service, a technology, a likely CVE — then the exploit.
honeypot.xlabs.com.br CONFIDENTIAL
XLabs Honeypot
HACK THE HACKERS.
- They scan your infrastructure.
- They hunt CVEs.
- They spray credentials.
- They look for admin panels.
- They send payloads.
- They try to find something vulnerable.
Then give them exactly what they came looking for.
Just not where the attacker expects.
XLabs Honeypot deploys fake attack surfaces, controlled vulnerable applications and deception environments that attract scanners, bots and human operators. The attacker believes they found a vulnerability; you start seeing who they are, what they hunt and how they intend to strike.
Hackers study your surface. Now your surface studies the hackers.
They want a vulnerability.
We give them one.
A scanner finds an exposed service. Fingerprints a technology. Flags a likely CVE. Sends the exploit. The application answers like a vulnerable target. The attacker keeps going.
- New requests.
- New payloads.
- New techniques.
- New attempts.
The attacker believes they are compromising the environment. In reality, they are feeding your threat intelligence.
The bait answers
The bait answers with the real product's behavior: same screens, same fields, same headers. The attacker keeps going, and nothing they send is ever executed.
You watch
All of it happens on a surface built to observe the attacker. Every attempt is recorded: origin, tooling, payload and the next move.
Hack the Hackers
Flip the attacker's advantage.
Usually the attacker chooses when to strike, what to test, which tools to use, which vulnerabilities to hunt and how long to stay hidden. Deception changes that relationship.
The attacker used to choose
- when to attack;
- what to test;
- which tools to use;
- which vulnerabilities to hunt;
- how long to stay hidden.
Now you control
- The target.
- The behavior.
- The environment.
The attacker starts revealing techniques inside infrastructure built specifically to observe them.
Don't chase the hacker. Make the hacker come to you.
C2
Command & Control for your deception network.
Every XLabs agent connects to XLabs Honeypot C2, so the whole deception estate can be managed from one place. Operate distributed sensors, follow events, manage versions and grow what the agent can do.
A C2 built to defend.
XLabs C2
Sensor 01GlobalProtect
Sensor 02AD FS
Sensor 03WordPress
Attack Telemetry
Threat Intelligence
One-Click Agent Update
A new version. One click. Full capability on the sensor.
The agent must not become forgotten software on a customer server. When a new version is ready, the administrator requests the update from the C2. One click. On the next check-in, the agent receives the instruction and starts updating.
- No SSH.
- No RDP.
- No logging into each server.
- No manual reinstalls.
New exploit. New technique. New version. Update.
CVE Traps
If attackers are hunting a CVE, we want to watch them hunt.
A critical vulnerability is published. Hours later the scans start. Then the first payloads. Then the automated campaigns. XLabs Honeypot turns CVEs into offensive observation points.
The sensor can reproduce the endpoints, interfaces and behavior exploit tooling expects. The attacker sends the exploit. We capture the attempt.
Without putting a truly vulnerable application into production.
Personas
The attacker sees the product they came looking for.
A generic honeypot is easy to spot. Good deception tells a story. XLabs Honeypot can take on behaviors associated with different technologies and surfaces.
GlobalProtect
The attacker hits / and gets the appliance behavior they expect.
/ 302 → /global-protect/login.esp
AD FS
Another persona can reproduce traits of a Microsoft AD FS environment.
SharePoint
Another surface can look like an exposed SharePoint install.
WordPress
Another can behave like a WordPress site that looks exposed and potentially vulnerable.
CVE-specific personas
The agent also answers the way a scanner expects when it hunts a specific vulnerability.
We do not show the attacker a bait menu. We show a target.
Payload Safe
We want to see the exploit. We do not want to hand over a server.
The platform captures offensive intent without turning the honeypot into infrastructure the attacker can use against someone else. The attempt is recorded. The response stays coherent with the deception scenario.
- SQL Injection
- Command Injection
- SSTI
- SSRF
- LFI
- RCE
- File Upload
- Authentication Bypass
- CVE Exploitation
We capture the payload. We do not need to run the real attack.
See What Hackers See
And more importantly: see what the attacker does next.
A single request is a log. Thousands of correlated interactions start to become threat intelligence.
- IP address
- ASN
- country
- User-Agent
- HTTP method
- URI
- parameters
- headers
- payload
- CVE hunted
- attack type
- severity
- request sequence
- reconnaissance behavior
- automated tooling
- repeat activity
- offensive infrastructure
Threat Intelligence.
Reconnaissance Intelligence
Before they exploit, attackers have to look.
And looking leaves traces. Scanners walk thousands of possibilities trying to learn what sits behind an IP. XLabs Honeypot turns that reconnaissance into telemetry.
/.env/.git/config/wp-login.php/manager/html/cli/_layouts//dana-na//global-protect//adfs/
You start to see what attackers are hunting today.
Attack Intelligence Loop
The attack on the honeypot can harden the real application.
They attack the bait. The bait learns. The defense evolves.
- Hacker
- XLabs Honeypot
- Payload Capture
- CVE / TTP / IOC
- Threat Intelligence
- SOC / SIEMXLabs WAF
Plans
Free, Pro and Enterprise. Same baits. Different C2.
Every plan runs the full bait catalog on the agent. Limits apply to sensors, users, log reading and C2 extras.
Free
- Active sensors 1
- Company users 2
- Log reading 7 days
- Persona isolation No
- Automatic updates No (manual in C2)
- Capture all HTTP Always on
- JA3 fingerprinting No
- Adaptive tarpit No
- Realtime alerts No
- Query API No
- Canary tokens No
- Attacker time burned No
- AI agent detection No
- Baits and façades Yes
Pro
- Active sensors 5
- Company users No limit
- Log reading 90 days
- Persona isolation Yes
- Automatic updates Yes
- Capture all HTTP Can turn off
- JA3 fingerprinting Yes
- Adaptive tarpit Yes
- Realtime alerts Yes
- Query API 3 keys
- Canary tokens No
- Attacker time burned No
- AI agent detection No
- Baits and façades Yes
Enterprise
- Active sensors No limit
- Company users No limit
- Log reading 365 days
- Persona isolation Yes
- Automatic updates Yes
- Capture all HTTP Can turn off
- JA3 fingerprinting Yes
- Adaptive tarpit Yes
- Realtime alerts Yes
- Query API 10 keys
- Canary tokens Yes
- Attacker time burned Yes
- AI agent detection Yes
- Baits and façades Yes
On-Premise Agent
Deception runs where you need it.
XLabs Honeypot uses agents you can deploy on Linux or Windows. The sensor stays on the infrastructure the customer defines. Management happens through XLabs C2. That places deception surfaces next to the environment the attacker expects to find.
Distributed deception. Centralized control.
- Internet
- Attack Surface
- XLabs Honeypot Agent
- XLabs C2
- Threat Intelligence
Deployment
Three steps from token to telemetry.
-
01
Install the sensor
The company admin generates a one-time installation token and installs the agent on Linux or Windows.
-
02
Attract the scan
The agent serves the persona and the CVE façades. The scanner finds a target and stays. The payload stops at the capture layer.
-
03
Read it in C2
Events land in the client console: who they are, what they hunted and how they tried to strike.
Built for Hackers.
Operated by Defenders.
We do not just want to block a request. We want to understand:
- Why did it arrive?
- What was it looking for?
- Which exploit was used?
- What did the attacker try next?
- Are other sensors seeing the same campaign?
- Can we turn this into protection?
That is the difference between logging attacks and building intelligence from them.
Access
Sign in to your operation's C2.
Attack logs, sensors, personas and agent setup for your company.
Companies
XLabs Honeypot C2
For the company's admins, analysts and readers: attack logs, sensors, one-click agent updates and team management.
Access C2 → portal.xlabs honey-pot.netWatch hackers at work.
honey-pot.net is the public lab for XLabs technology. Intentionally vulnerable surfaces are exposed to the internet so we can observe real scanners, bots, exploits and campaigns.
Open honey-pot.net → Internet attackers. Real payloads. Real telemetry. Controlled targets.XLabs Honeypot
HACK THE HACKERS.
They hunt vulnerabilities. We build vulnerabilities for them to find. They send exploits. We study the exploits. They do reconnaissance. We watch the reconnaissance. They try to map your infrastructure.
Meanwhile you are mapping theirs.
Don't just block the attacker.
Study him.