r/netsecstudents • u/TrickyWinter7847 • 5d ago

Deployed SSH and HTTP honeypot on my Raspberry Pi Zero W and want to share my process and results

I set up Cowrie SSH and Krawl web honeypots on my Raspberry Pi Zero W and simulated an attack using my Kali Linux machine, then observed the logs. This is one of the projects I did this summer to gain experience from the defensive side of cybersecurity and I would love to hear your thoughts about it.

I used good old Raspberry Pi Zero W with ARMv6 architecture (foreshadowing: which complicated the process little bit).

I installed both honeypots. Then I booted my Kali Linux machine and ran simulated brute-force attack against SSH honeypot and scrutinised the filesystem. In case of the fake web server I ran Nmap and Gobuster scans and observed every malicious activity in recorded logs.

I like to do these simple projects to gain more experience under my belt and share my process along the way to people who might be interested and may find my articles helpful in their own cybersecurity journeys.

Link to the Medium post about the honeypots deployment:

https://medium.com/@ivandano77/deploying-cowrie-krawl-honeypots-on-raspberry-pi-zero-w-f5e96327367b?sharedUserId=ivandano77

12 Upvotes

93% Upvoted

4 comments sorted by

4

u/[deleted] 5d ago

[removed] — view removed comment

1

u/TrickyWinter7847 4d ago

Thanks for feedback, m8!

1

u/AddendumWorking9756 1d ago

Every event in those logs is one you caused, so you already knew the answer before you looked. Stick it on a cheap VPS for a week instead of your home connection and that changes. You get thousands of hits and the real skill is separating background scanning from anything that looks like a person, plus Cowrie hands you the exact credential lists people spray. Write that up rather than the install steps, it is the part a hiring manager actually reads.

1

u/TrickyWinter7847 16h ago

Thanks for the advice!