Skip to content

Krawl

A deception server that detects, delays and profiles attackers, web crawlers and automated scanners.

Get started Try the demo GitHub

Config builder Every setting as a form field. Copy the result as config.yaml, environment variables or Helm values.

Rule builder Write a YARA rule, check it against Krawl's rule contract, and test it on a request before uploading it.

Krawl serves realistic fake applications, such as admin panels, exposed configuration files and leaked credentials. It detects attacks with YARA rules, answers each one with a convincing fake reply, and classifies every client IP by its behaviour. A dashboard shows all of it, and banlists export to your firewall.

Krawl dashboard

Quick start

docker run -d \
  -p 5000:5000 \
  -e KRAWL_DASHBOARD_SECRET_PATH="/my-secret-dashboard" \
  -e KRAWL_DASHBOARD_PASSWORD="my-secret-password" \
  -v krawl-data:/app/data \
  --name krawl \
  ghcr.io/blessedrebus/krawl:latest

The trap answers on http://localhost:5000, the dashboard on http://localhost:5000/my-secret-dashboard. Docker Compose, Kubernetes and Helm are covered in Deployment modes.

Upgrading from 2.4?

Read Upgrading from 2.4 to 3.0 first.

Documentation