Honeypots are decoy systems (virtual machines, containers, services) designed to attract, detect, and study attackers. Honeypots mimic real production systems (SSH, HTTP, SMB, FTP, databases) to lure attackers into interacting. Security teams monitor honeypots to capture attacker TTPs (tactics, techniques, procedures), malware samples, C2 infrastructure, and exploit attempts. Honeypots provide early warning of attacks and intelligence for threat hunting. 90% of organizations use honeypots for threat intelligence (SANS 2023).
Honeypot Statistics: 90% of organizations use honeypots for threat intel. 70% detect attacks within 24 hours. 50% capture previously unknown malware (zero-day). Average payback time: 2-4 weeks.
Common honeypot targets:
Emulate limited services (fake SSH, HTTP). Easy to deploy, low risk, low maintenance. Capture basic attack info (IP, credentials, exploit attempts). Examples: Honeyd, Dionaea (SMB), Glastopf (web).
Emulate full services (SSH, FTP, Telnet). Capture more detailed attacker behavior (commands, malware). Examples: Cowrie (SSH/Telnet), Kippo (SSH), Conpot (ICS/SCADA).
Real systems (full OS, vulnerable applications). Capture zero-day exploits, advanced malware. Higher risk (attacker could pivot). Examples: T-Pot (all-in-one), HoneyDrive, custom VMs.
Global honeypot networks collecting attack data. Shodan monitors internet-wide scanning. GreyNoise tags benign scanners vs malicious.
Medium-interaction SSH/Telnet honeypot. Logs attacker commands, downloads malware, captures credentials. Supports SFTP, SCP emulation. Python-based.
Comprehensive honeypot platform (20+ honeypots). Includes Cowrie (SSH), Dionaea (SMB), ElasticPot (Elasticsearch), Honeytrap, Glastopf (web), Mailoney (SMTP). ELK stack for visualization.
Low-interaction honeypot. Captures malware (WannaCry, NotPetya, EternalBlue) via SMB. Emulates HTTP, FTP, MSSQL, SIP.
Modular honeypot (SSH, HTTP, SMB, FTP, RDP, MySQL, Redis). Alerts via Slack, email, Syslog. Easy deployment (Python).
Original honeypot daemon (2002). Creates virtual hosts simulating arbitrary services (TCP/UDP). Scriptable (Python, Perl).
// Cowrie SSH honeypot deployment (Docker)
# Pull Cowrie image
docker run -d -p 2222:2222 cowrie/cowrie
# Configure cowrie.cfg (disable real commands)
[ssh]
enabled = true
listen_port = 2222
listen_addr = 0.0.0.0
# Logs stored in /var/lib/cowrie/log/
# Attackers think they are on real Ubuntu system
# T-Pot deployment (ISO or Docker)
# Includes 20+ honeypots + ELK dashboard
# Download from tpot.telekom.com
# OpenCanary deployment
pip install opencanary
opencanaryd --copyconfig
# Edit opencanary.conf (add ports: 22, 80, 443, 445, 3306, 6379)
sudo opencanaryd --start
This demonstration simulates attacker interaction with Cowrie SSH honeypot:
This is a simulated demonstration. Real SSH honeypots (Cowrie) log attacker commands, download malware, and capture credentials. Deploy in DMZ or cloud (AWS, Azure). Isolate from production networks (attacker cannot pivot).
Honeypots capture attacker IPs attempting SSH brute force, web exploits, SMB scans. Feed IPs to firewall blocklists (fail2ban, pfSense, Cloudflare).
Capture malware binaries (Mirai, ransomware, trojans). Extract C2 domains, cryptocurrency wallets, RSA keys. Share with VirusTotal, MISP, ISACs.
Analyze attacker commands: privilege escalation (sudo, SUID), lateral movement (ssh, rdp), persistence (cron, systemd).
Place honeypots in isolated DMZ or separate VLAN. Restrict outbound traffic (prevent attacker pivoting). Use network segmentation.
Forward honeypot logs to SIEM (Splunk, ELK). Set up alerts for suspicious activity (SSH login attempts, malware downloads).
Deploy diverse honeypots to catch different attack vectors. Use T-Pot (all-in-one) for comprehensive coverage.
Share attacker IPs, malware hashes, C2 domains with Information Sharing and Analysis Centers (ISACs). Contribute to MISP threat intel platform.
Best Practice - Isolate Honeypots + Log Everything: Deploy honeypots in isolated DMZ (separate VLAN). Use T-Pot or Cowrie for SSH/SMB attacks. Forward logs to SIEM (ELK, Splunk). Set up alerts for attacks. Share threat intelligence (MISP, ISACs). Regularly update honeypot software.
Honeypots are legal in most countries for defensive purposes (detecting attackers). However, entrapment laws may apply (enticing attacker to commit crime).
Honeypots are legal for defensive security (detecting attackers). Do not entrap or induce criminal activity. Comply with GDPR (anonymize IP addresses if logging EU citizens). Consult legal counsel before deploying honeypots.
Important: This guide is for educational and defensive purposes only. Deploy honeypots responsibly and ethically.
All-in-one honeypot platform (20+ honeypots + ELK stack).
Medium-interaction SSH honeypot (logs commands, malware).
Modular honeypot (SSH, HTTP, SMB, RDP, MySQL, Redis).