# mr-r3b00t/honey_cracked architecture

> Architecture diagram of the GitHub repository mr-r3b00t/honey_cracked, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mr-r3b00t/honey_cracked
- Repository: https://github.com/mr-r3b00t/honey_cracked

## Overview

This is an RDP credential honeypot: it accepts remote connection attempts, negotiates an RDP security path, captures plaintext credentials or a NetNTLMv2 hash, and closes the connection without forwarding it. An analyzer reports on stored captures and can check guesses against named accounts. The README also documents password-cracking materials, but the supplied tree does not include the stated listener, analyzer, or wordlists directory; their paths below follow README filenames. No source excerpts were available, so internal call ownership beyond documented behavior is omitted.

Main entry points: [`CRACKING.md`](https://github.com/mr-r3b00t/honey_cracked/blob/main/CRACKING.md) (Cracking runbook), [`passwords.txt`](https://github.com/mr-r3b00t/honey_cracked/blob/main/passwords.txt) (Password lists), [`ntlm_hashes_51K.txt`](https://github.com/mr-r3b00t/honey_cracked/blob/main/ntlm_hashes_51K.txt) (Hash lists), [`generator_space.rule`](https://github.com/mr-r3b00t/honey_cracked/blob/main/generator_space.rule) (Cracking rules)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_capture["Credential capture"]
  node_listener["RDP listener"]
  node_negotiation["Security negotiation"]
  node_tls["TLS credentials"]
  node_legacy["Legacy credentials"]
  node_nla["NLA credentials"]
  node_capture_store[("Capture database")]
  node_capture_exports["Capture exports"]
  node_source_state[("NLA source state")]
end

subgraph group_analysis["Capture analysis"]
  node_analyzer["Capture analyzer"]
  node_reports["Reports and checks"]
end

subgraph group_cracking["Cracking materials"]
  node_cracking_runbook["Cracking runbook<br/>[CRACKING.md]"]
  node_password_lists["Password lists<br/>[passwords.txt]"]
  node_hash_lists["Hash lists"]
  node_rule_files["Cracking rules"]
  node_observed_masks["Observed patterns<br/>[observed.hcmask]"]
end

node_attacker(("RDP client"))
node_operator(("Honeypot operator"))

node_attacker -->|"connects via RDP"| node_listener
node_listener -->|"negotiates security"| node_negotiation
node_negotiation -->|"selects TLS"| node_tls
node_negotiation -->|"selects legacy"| node_legacy
node_negotiation -->|"offers NLA"| node_nla
node_tls -->|"records plaintext"| node_capture_store
node_legacy -->|"records plaintext"| node_capture_store
node_nla -->|"records hash"| node_capture_store
node_listener -->|"writes captures"| node_capture_exports
node_listener -->|"persists refusals"| node_source_state
node_analyzer -->|"reads captures"| node_capture_store
node_analyzer -->|"produces reports"| node_reports
node_operator -->|"runs analysis"| node_analyzer
node_cracking_runbook -->|"uses lists"| node_password_lists
node_cracking_runbook -->|"uses hashes"| node_hash_lists
node_cracking_runbook -->|"uses rules"| node_rule_files
node_cracking_runbook -->|"uses patterns"| node_observed_masks

click node_cracking_runbook "https://github.com/mr-r3b00t/honey_cracked/blob/main/CRACKING.md"
click node_password_lists "https://github.com/mr-r3b00t/honey_cracked/blob/main/passwords.txt"
click node_hash_lists "https://github.com/mr-r3b00t/honey_cracked/blob/main/ntlm_hashes_51K.txt"
click node_rule_files "https://github.com/mr-r3b00t/honey_cracked/blob/main/generator_space.rule"
click node_observed_masks "https://github.com/mr-r3b00t/honey_cracked/blob/main/observed.hcmask"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_listener,node_negotiation,node_tls,node_legacy,node_nla,node_capture_store,node_capture_exports,node_source_state,node_attacker toneBlue
class node_analyzer,node_reports toneAmber
class node_cracking_runbook,node_password_lists,node_hash_lists,node_rule_files,node_observed_masks toneMint
class node_operator toneIndigo
```

## Components

### Credential capture

- **RDP listener**
- **Security negotiation**
- **TLS credentials**
- **Legacy credentials**
- **NLA credentials**
- **Capture database**
- **Capture exports**
- **NLA source state**

### Capture analysis

- **Capture analyzer**
- **Reports and checks**

### Cracking materials

- [Cracking runbook](https://github.com/mr-r3b00t/honey_cracked/blob/main/CRACKING.md): `CRACKING.md`
- [Password lists](https://github.com/mr-r3b00t/honey_cracked/blob/main/passwords.txt): `passwords.txt`
- [Hash lists](https://github.com/mr-r3b00t/honey_cracked/blob/main/ntlm_hashes_51K.txt): `ntlm_hashes_51K.txt`
- [Cracking rules](https://github.com/mr-r3b00t/honey_cracked/blob/main/generator_space.rule): `generator_space.rule`
- [Observed patterns](https://github.com/mr-r3b00t/honey_cracked/blob/main/observed.hcmask): `observed.hcmask`

### Other components

- **RDP client**
- **Honeypot operator**

## Connections

- RDP client → RDP listener: connects via RDP
- RDP listener → Security negotiation: negotiates security
- Security negotiation → TLS credentials: selects TLS
- Security negotiation → Legacy credentials: selects legacy
- Security negotiation → NLA credentials: offers NLA
- TLS credentials → Capture database: records plaintext
- Legacy credentials → Capture database: records plaintext
- NLA credentials → Capture database: records hash
- RDP listener → Capture exports: writes captures
- RDP listener → NLA source state: persists refusals
- Capture analyzer → Capture database: reads captures
- Capture analyzer → Reports and checks: produces reports
- Honeypot operator → Capture analyzer: runs analysis
- Cracking runbook → Password lists: uses lists
- Cracking runbook → Hash lists: uses hashes
- Cracking runbook → Cracking rules: uses rules
- Cracking runbook → Observed patterns: uses patterns