HACKING PROJECT · network · Intermediate
Honeypot on VPS Deployment
Stand up an internet-exposed decoy system that safely captures and analyzes real-world attacker behavior and IOCs.
Defenders often lack early, high-fidelity intelligence on who is attacking internet-facing assets and how, because production logs are noisy and attribution is hard. Real attack traffic against a controlled decoy provides ground-truth TTPs, credentials sprayed, and malware dropped — data most students never get to observe safely. Standing exposed services on a cheap VPS turns the public internet into a live threat-intel feed.
**What you'll build**
Deploy layered honeypots on a hardened, isolated VPS — low-interaction (Cowrie SSH/Telnet, Dionaea) and optionally high-interaction or web decoys (T-Pot framework) — capturing session transcripts, dropped payloads, and source telemetry. Centralize logs into an ELK dashboard, geolocate and enrich attacker IPs, and extract IOCs. Strictly segment the honeypot from any real infrastructure to prevent pivot.
**Objective** — Stand up an internet-exposed decoy system that safely captures and analyzes real-world attacker behavior and IOCs.
**Expected outcome** — A running honeypot with an attack-telemetry dashboard, an IOC/TTP report on observed campaigns, and a documented isolation/hardening architecture.
**Difficulty** — Intermediate — deployment is straightforward but safe isolation, exposure hygiene, and meaningful analysis require care.
**Primary category** — Threat Intelligence / Deception; Secondary = SOC, Malware Analysis
**Security domains** — Primary = Threat Intelligence; Secondary = Blue Team, Security Research, Malware Analysis, Incident Response
**Technical focus** — Deception technology, honeypot engineering, IOC extraction, log aggregation, threat enrichment, attacker TTP profiling, VPS hardening, network segmentation, malware collection
**Core technologies** — Languages: Python, Bash; Frameworks/Libraries: T-Pot, Docker Compose; Security Tools: Cowrie, Dionaea, Suricata (bundled in T-Pot), fail2ban, MISP; Cloud/Infra: VPS (DigitalOcean/AWS/Linode), Docker, firewall (ufw/iptables/security groups); AI/Data: ELK/Kibana, GeoIP, threat-intel feeds; Databases: Elasticsearch, SQLite
**Where it's valued** — Threat intel vendors, MSSP/SOC, research labs, finance, government/CERT teams
**Careers it builds toward** — Threat Intelligence Analyst, SOC Analyst, Security Researcher, Deception Engineer, Malware Analyst
**Framework alignment**
• MITRE ATT&CK: Captures Valid Accounts/Brute Force (T1110), Exploit Public-Facing Application (T1190), Ingress Tool Transfer (T1105), Command and Scripting Interpreter (T1059), Application Layer Protocol C2 (T1071); PRE-ATT&CK reconnaissance (Active Scanning T1595)
• NIST CSF 2.0: Detect (DE.CM, DE.AE), Identify (ID.RA threat intelligence), Respond (RS.AN)
• OWASP: Web-decoy variants observe OWASP Top 10 exploitation (Injection, Broken Access Control); otherwise N/A
• CIS Controls v8: 13 (Network Monitoring and Defense), 8 (Audit Log Management), 4 (Secure Configuration), 7 (Continuous Vulnerability Management)
**Innovation** — Improved Existing Solution — honeypots are established, but curating original attack-campaign intelligence and IOC feeds gives real research value. Scores: Innovation 5/10, Startup 4/10, Enterprise-Readiness 7/10, Patent = No.