Skip to content
cccskills
FreePublished on GitHub

implementing-network-deception-with-honeypots

Dağıt: and manage network honeypots using OpenCanary, T-Pot, or Cowrie to tespit etmeunauthorized access, lateral movement, and attacker reconnaissance.

The English summary is being prepared. Showing the original description.

See how to install

Files included (1)

  • SKILL.md3.3 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Implementing Network Deception with Honeypots

Ne Zaman Kullanılır

  • Dağıt:ing yaparken deception technology to tespit etmelateral movement
  • To create early warning indicators for network intrusion
  • During security architecture design to add Tespit depth
  • monitoring yaparken for unauthorized internal scanning or credential theft
  • To gather threat intelligence on attacker techniques and tools

Ön Gereksinimler

  • Linux server or VM for honeypot Dağıt:ment (Ubuntu 22.04+ recommended)
  • Python 3.8+ with pip for OpenCanary installation
  • Docker for T-Pot or containerized Dağıt:ment
  • Network segment with appropriate VLAN configuration
  • SIEM integration for alert forwarding (syslog, webhook, or file-based)
  • Firewall rules allowing inbound connections to honeypot services

İş Akışı

  1. Plan Dağıt:ment: Select honeypot types and network placement strategy.
  2. Install Honeypot: Dağıt: OpenCanary, Cowrie, or T-Pot on dedicated host.
  3. Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
  4. Kur: Alerting: Configure log forwarding to SIEM and alert channels.
  5. Dağıt: Canary Tokens: Place credential files, shares, and DNS entries.
  6. Monitor Interactions: Analyze honeypot logs for attacker activity.
  7. Tune and Maintain: Update configurations based on Tespit results.

Key Concepts

ConceptDescription
OpenCanaryLightweight Python honeypot with modular service emulation
CowrieMedium-interaction SSH/Telnet honeypot capturing commands
T-PotMulti-honeypot platform with ELK stack visualization
Canary TokenTripwire credential or file that alerts when accessed
Low-InteractionEmulates services at protocol level without full OS
High-InteractionFull OS honeypot capturing complete attacker sessions

Tools & Systems

ToolPurpose
OpenCanaryModular honeypot daemon with service emulation
CowrieSSH/Telnet honeypot with session recording
T-PotAll-in-one multi-honeypot platform
DionaeaMalware-capturing honeypot for exploit Tespit
Splunk/ElasticSIEM for honeypot alert aggregation

Output Format

Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]
<!-- ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih Yetkisiz kullanim/kopyalama tespit edilebilir. hash: 88bac31ff3ccb06f -->

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

21st.dev Magic MCP — AI-powered UI component generation via natural language. Access to 21st.dev component library, SVGL brand logos, and real-time preview. Generate React/Tailwind components with /ui command.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

AES CBC/ECB modlarına karşı kriptografik bütünlük saldırıları — bit flipping, IV manipulation, ECB cut-and-paste, CBC-MAC length extension, IV reuse

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

AES-GCM ve ChaCha20-Poly1305 nonce yeniden kullanımı saldırısı — GF(2^128) polinom kök bulma ile Hash Key kurtarma ve MAC sahteciliği.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

tespit etmeabnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly Tespit.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to tespit etmereentrancy, integer overflow, access control, and other vulnerability classes before Dağıt:ment to Ethereum mainnet.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

Parses Kubernetes API server audit logs (JSON lines) to tespit etmeexec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat Tespit rules from audit event patterns. Use investigating yaparken Kubernetes cluster compromise or building k8s-specific SIEM Tespit rules.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

See all skills by MustafaKemal0146

Report a problem with this skill