How to Set Up a Honeypot for Cyber Attacks

Author: Trix Cyrus

Waymap Pentesting tool: Click Here
TrixSec Github: Click Here

A honeypot is a security mechanism set up to detect, deflect, or study cyber attacks by mimicking vulnerable systems. The goal is to trick attackers into interacting with the honeypot, allowing you to monitor their activities without risking critical systems.

In this guide, we'll walk through the steps to set up a basic honeypot for cybersecurity research and defense.

Step 1: Understanding the Types of Honeypots

Before setting up a honeypot, you should understand the different types available:

Low-interaction honeypots simulate specific services that attackers might interact with (e.g., SSH, HTTP). They are easy to set up but provide limited insight into an attacker's methods.

High-interaction honeypots simulate full systems and allow attackers to perform a wide range of activities. These honeypots offer more detailed information but are more complex and risky.
For beginners, a low-interaction honeypot is usually the best option to start with.

Step 2: Choose a Honeypot Software

There are various honeypot software tools available that help you set up your trap. Some popular options include:

Dionaea – A low-interaction honeypot aimed at catching malware.
Cowrie – An SSH and Telnet honeypot that records all actions of an attacker.
Honeyd – A versatile honeypot that can simulate various network services.

For this tutorial, we'll use Cowrie, a simple SSH honeypot, to track and log potential attacks.

Step 3: Set Up Your Environment

You'll need a dedicated environment for your honeypot to ensure that your real systems remain safe.

Create a virtual machine (VM): Use software like VirtualBox or VMware to create an isolated VM. Honeypots are prone to attacks, so isolating them from your real system is crucial.
Choose a lightweight Linux distribution for your VM, such as Ubuntu or Debian.

Step 4: Install and Configure Cowrie
Update your system:

sudo apt update && sudo apt upgrade -y

Install the required dependencies:

sudo apt install git python3-virtualenv libssl-dev libffi-dev build-essential -y

Clone the Cowrie repository:

git clone https://github.com/cowrie/cowrie

Navigate to the Cowrie directory and create a virtual environment:

cd cowrie
virtualenv cowrie-env
source cowrie-env/bin/activate

Install Cowrie’s Python dependencies:

pip install -r requirements.txt

Configure Cowrie by editing the configuration file:

cp etc/cowrie.cfg.dist etc/cowrie.cfg
nano etc/cowrie.cfg

You can modify settings like the SSH banner or logging preferences.

Step 5: Start Your Honeypot
Once configured, you can start Cowrie using the following command:

bin/cowrie start

Cowrie will now simulate an SSH service that logs any interaction with attackers.

Step 6: Monitor Logs and Activity

Cowrie logs everything the attacker does once they log into the honeypot. You can view the logs in the log/ directory within the Cowrie folder.

For example, to view a recent session:

cat log/cowrie.log

Step 7: Stay Safe
When setting up a honeypot, always remember the following safety tips:

Isolate the honeypot: Use a separate VM or network segment to prevent attackers from breaching your real systems.
Regular monitoring: Always monitor the logs to ensure the honeypot isn't being used to attack other systems.
Updates: Keep your honeypot software updated to protect against vulnerabilities.

~TrixSec