Fixes Issue: #6403

Description: This PR introduces a high-performance, lock-free honeypot detection system to help users reduce noise and avoid scanning traps that yield infinite or excessive matches.

Technical Implementation:

Options & CLI: Added the -hp / -honeypot flag.
Efficiency: Implemented HoneypotTracker using sync.Map and atomic counters. This ensures zero bottlenecking during highly concurrent scans across multiple hosts.
Logic: Once a target host exceeds 15 successful template matches, the system flags it as a honeypot, logs a single warning, and skips all subsequent templates for that specific host.
UX: The warning message is triggered only once per host to maintain a clean terminal output.

Testing Performed:

Unit Tests: Verified logic in pkg/core/ and confirmed flag registration.
Manual Stress Test: Confirmed that execution stops precisely after the threshold when firing against a mock server designed to return positive matches for every request.
Compilability: Successfully built with go build ./cmd/nuclei.

Impact: Significantly reduces false positives and resource consumption when encountering honeypots or misconfigured targets.

/claim #6403

Summary by CodeRabbit

  • New Features
    • Added --honeypot / -hp command-line flag to enable honeypot detection functionality
    • Honeypot detection automatically tracks suspected malicious inputs on a per-host basis throughout the scanning process
    • When honeypots are detected, the scanner automatically skips further template execution on those inputs to reduce noise and improve overall scanning efficiency

Claim

Total prize pool $250
Total paid $0
Status Pending
Submitted February 27, 2026
Last updated February 27, 2026

Contributors

AS

astraxm-proton-me

@astraxm-proton-me

100%

Sponsors

PR

ProjectDiscovery

@projectdiscovery

$250