TANNER review
An open-source web honeypot component for analyzing requests and emulating application vulnerabilities.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
TANNER is an open-source, self-hosted service for security practitioners operating web honeypot infrastructure. It works with SNARE to evaluate incoming HTTP requests, classify activity, compose responses and emulate web application vulnerabilities. Its application-focused scope suits teams that want dynamic deception for HTTP services rather than a broader network, credential or endpoint decoy system. The product also serves manually added and user-generated dorks while tracking and evaluating attacker sessions.
Its strongest fit is with an existing SNARE deployment. TANNER evaluates requests received from SNARE, then uses the results to change responses and present behavior associated with vulnerabilities such as SQL injection, command execution, XSS, LFI, RFI, XXE and template injection. Redis provides data storage, while the REST API and web interface support operational access. Docker Compose deployment is also documented, giving teams a defined path for running the component alongside its supporting services.
The open-source model and self-hosted deployment make TANNER suitable for teams that want control over a web deception component and can operate its surrounding infrastructure. Its integration with SNARE is also its main boundary: organizations looking for an independent honeypot product may need a different option. TANNER is best chosen when the goal is dynamic HTTP application emulation, session evaluation and response composition within a SNARE-based architecture. It is less suitable for teams seeking broad decoy coverage beyond web applications or a standalone managed service.
Questions about TANNER
What does TANNER run on? Web and Linux. It runs self-hosted.
What does TANNER integrate with? 4 integrations: SNARE, Redis, Docker and PHPox.
Who is TANNER built for? Solo users, small businesses, mid-market companies and enterprises (our editorial estimate).
TANNER pros and cons
- Where it wins
- Analyzes SNARE traffic and changes honeypot responses
- Emulates SQL injection, XSS, command execution and other vulnerabilities
- Offers Redis, REST, web interface and Docker Compose support
- Where it doesn't
- Requires SNARE rather than operating as a standalone honeypot
- Focuses on application-level deception only
- Self-hosted deployment requires infrastructure management
TANNER fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update