Machine learning no-code testing and AI assistant, generating codes and static analysis, generating comments and floating hints. Used by Tencent, Huawei, SHEIN, TRANSSION, ICBC, etc.
Powerful & Easy-to-Use Video Face Swapping and Editing Software.
Key parameters and specifications
Key parameters and specifications
Parameter
Value
Language
Go
Category
Applications
Subcategory
Specialists
Stars
2,198
Forks
220
Contributors
21
Created date
2022-05-08
Updated date
2026-10-15
Stars in 1 day
1
Stars in 7 days
6
Rank
5,146
Previous rank
3,851
Rank change
-1,295
7-day stars rank
5,062
Previous 7-day stars rank
5,487
7-day stars rank change
425
Total stars rank
5,887
Previous total stars rank
5,885
Total stars rank change
-2
Country
Italy
README summary
Beelzebub **Open-source deception framework. Turn interactions into security evidence. **Explore Beelzebub Platform** · Documentation · Quick start Beelzebub gives security teams a configurable way to study activity directed at decoy services. Define the environment an attacker encounters, choose how it responds, and capture the interaction for investigation. Run the framework independently or connect it to Beelzebub Platform. Why Beelzebub **Deploy decoys that fit your environment. ** Define services, routes, and response rules in YAML. Use static handlers for predictable behavior or LLM
-powered responses for adaptive interactions. Extend the runtime with trusted Go plugins when you need custom behavior. ** Capture evidence from decoy interactions, including commands, HTTP request details, and session context, depending on the protocol. Give analysts a record of activity directed at the service to support investigation. ** Inspect logs locally, publish structured events to RabbitMQ, or enable Beelzebub Platform reporting. Monitor runtime activity through Prometheus metrics and choose where captured data is sent. See it in action Watch an LLM
-powered decoy respond to attacker input. The demo illustrates how generated responses can sustain an interaction beyond a fixed set of command handlers. How it works Define services and rules in YAML, validate the configuration, and start the runtime. Trusted Go plugins are compiled into the runtime to extend services and responses. Each service handles incoming interactions and emits evidence through the configured event output. LLM responses require a configured provider; static handlers can run without one. The framework supports
**SSH, HTTP, TCP, TELNET, and MCP**. MCP decoys expose bait tools that make suspicious invocations observable during controlled agent testing. They can provide evidence of prompt-injection attempts; they do not guarantee detection of every attempt. Deployment options include a local Go binary, Docker Compose, and Kubernetes with Helm. See the architecture guide for runtime behavior and extension boundaries. Explore the decoys Start with one of the **18 example configurations** in configurations/services. Open a YAML file to inspect its
rules and adapt it to your environment. **LLM** examples require a configured provider; WordPress uses it for its catch-all route. Check your deployment's port mappings when enabling additional examples. Get started You need **Git, a shell, and Docker Engine with Compose v2**. Use an **isolated lab host** with authorization for all configured listeners: the installer starts a bundle of example services, including privileged ports. On Linux it can enable **host networking**; Docker does not provide network isolation in that
mode. Use synthetic credentials and review the production safety guide before exposing services to the internet. Leave the Platform token blank when prompted to run independently. The runtime validates its configuration before starting listeners. Test the default HTTP decoy and inspect its logs: Expect ** ** from the bundled HTTP example on port 8080. This is the decoy's configured response, confirming that the listener is reachable. If the installer skipped an occupied port, resolve the conflict before testing. Stop the lab when
finished: For a single-service setup or another deployment method, follow the installation guide. Beelzebub Platform The open-source framework
Frequently asked questions
How many stars and forks are recorded?
beelzebub-labs/beelzebub has 2,198 stars and 220 forks.
What is the repository rank?
beelzebub-labs/beelzebub is ranked 5,146.
What language and category are recorded?
beelzebub-labs/beelzebub has 2,198 stars, uses Go and belongs to Applications.
Which repository is closest in rank?
beelzebub-labs/beelzebub is compared with kaixxx/noScribe, ranked 5,143 with 2,202 stars.
Beelzebub gives security teams a configurable way to study activity directed at decoy services. Define the environment an attacker encounters, choose how it responds, and capture the interaction for investigation. Run the framework independently or connect it to Beelzebub Platform.
Why Beelzebub
Deploy decoys that fit your environment. Define services, routes, and response rules in YAML. Use static handlers for predictable behavior or LLM-powered responses for adaptive interactions. Extend the runtime with trusted Go plugins when you need custom behavior.
Observe what happens after contact. Capture evidence from decoy interactions, including commands, HTTP request details, and session context, depending on the protocol. Give analysts a record of activity directed at the service to support investigation.
Bring evidence into your workflow. Inspect logs locally, publish structured events to RabbitMQ, or enable Beelzebub Platform reporting. Monitor runtime activity through Prometheus metrics and choose where captured data is sent.
See it in action
Watch an LLM-powered decoy respond to attacker input. The demo illustrates how generated responses can sustain an interaction beyond a fixed set of command handlers.
How it works
Define services and rules in YAML, validate the configuration, and start the runtime. Trusted Go plugins are compiled into the runtime to extend services and responses. Each service handles incoming interactions and emits evidence through the configured event output. LLM responses require a configured provider; static handlers can run without one.
The framework supports SSH, HTTP, TCP, TELNET, and MCP. MCP decoys expose bait tools that make suspicious invocations observable during controlled agent testing. They can provide evidence of prompt-injection attempts; they do not guarantee detection of every attempt.
Deployment options include a local Go binary, Docker Compose, and Kubernetes with Helm. See the architecture guide for runtime behavior and extension boundaries.
Explore the decoys
Start with one of the 18 example configurations in configurations/services. Open a YAML file to inspect its rules and adapt it to your environment.
Examples range from banners and selected responses to interactive exchanges. LLM examples require a configured provider; WordPress uses it for its catch-all route. Check your deployment's port mappings when enabling additional examples.
Get started
You need Git, a shell, and Docker Engine with Compose v2. Use an isolated lab host with authorization for all configured listeners: the installer starts a bundle of example services, including privileged ports. On Linux it can enable host networking; Docker does not provide network isolation in that mode.
Use synthetic credentials and review the production safety guide before exposing services to the internet.
git clone https://github.com/beelzebub-labs/beelzebub.git
cd beelzebub
./install.sh --docker
Platform reporting is optional. Leave the Platform token blank when prompted to run independently. The runtime validates its configuration before starting listeners.
Expect 401 Unauthorized from the bundled HTTP example on port 8080. This is the decoy's configured response, confirming that the listener is reachable. If the installer skipped an occupied port, resolve the conflict before testing. Press Ctrl+C to stop following logs.
Stop the lab when finished:
docker compose down
For a single-service setup or another deployment method, follow the installation guide.
Beelzebub Platform
The open-source framework is the foundation: deploy, operate, and extend it independently. Beelzebub Platform is the managed product for teams that need to coordinate deception across environments and connect runtime evidence to a broader security workflow.
Explore the platform's deployment, investigation, and reporting capabilities, and see how they fit your team's requirements.
For development, use the Go version declared in go.mod, Git, and Make. Build with make build; run make test.unit, go vet ./..., and make validate-all before submitting runtime changes. The development workflow covers integration tests and their Docker dependencies.
Thank you to JetBrains for supporting development with tools through its open-source support program.
