pinkpixel-dev/implementing-network-deception-with-honeypots
SKILLS/implementing-network-deception-with-honeypots/SKILL.md
Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.
$ install --global
skillsauthnpx skillsauth add pinkpixel-dev/skills-collection-2 implementing-network-deception-with-honeypotsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 29, 2026, 4:23 AM299.8s3 files scanned
SKILL.md
- name:
- implementing-network-deception-with-honeypots
- description:
- Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.
- domain:
- cybersecurity
- subdomain:
- deception-technology
- tags:
- [deception, honeypot, opencanary, cowrie, t-pot, detection, lateral-movement, network-security]
- version:
- 1.0
- author:
- mahipal
- license:
- Apache-2.0
Implementing Network Deception with Honeypots
When to Use
- When deploying deception technology to detect lateral movement
- To create early warning indicators for network intrusion
- During security architecture design to add detection depth
- When monitoring for unauthorized internal scanning or credential theft
- To gather threat intelligence on attacker techniques and tools
Prerequisites
- Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
- Python 3.8+ with pip for OpenCanary installation
- Docker for T-Pot or containerized deployment
- Network segment with appropriate VLAN configuration
- SIEM integration for alert forwarding (syslog, webhook, or file-based)
- Firewall rules allowing inbound connections to honeypot services
Workflow
- Plan Deployment: Select honeypot types and network placement strategy.
- Install Honeypot: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
- Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
- Set Up Alerting: Configure log forwarding to SIEM and alert channels.
- Deploy Canary Tokens: Place credential files, shares, and DNS entries.
- Monitor Interactions: Analyze honeypot logs for attacker activity.
- Tune and Maintain: Update configurations based on detection results.
Key Concepts
| Concept | Description | |---------|-------------| | OpenCanary | Lightweight Python honeypot with modular service emulation | | Cowrie | Medium-interaction SSH/Telnet honeypot capturing commands | | T-Pot | Multi-honeypot platform with ELK stack visualization | | Canary Token | Tripwire credential or file that alerts when accessed | | Low-Interaction | Emulates services at protocol level without full OS | | High-Interaction | Full OS honeypot capturing complete attacker sessions |
Tools & Systems
| Tool | Purpose | |------|---------| | OpenCanary | Modular honeypot daemon with service emulation | | Cowrie | SSH/Telnet honeypot with session recording | | T-Pot | All-in-one multi-honeypot platform | | Dionaea | Malware-capturing honeypot for exploit detection | | Splunk/Elastic | SIEM for honeypot alert aggregation |
Output Format
Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]
Related Skills
pinkpixel-dev/performing-lateral-movement-with-wmiexec
tools
VerifiedTrustedCommunity
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-lateral-movement-detection
data-ai
VerifiedTrustedCommunity
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-kubernetes-penetration-testing
tools
VerifiedTrustedCommunity
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-kubernetes-etcd-security-assessment
testing
VerifiedTrustedCommunity
Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.
1SKILL.mdUpdated Aug 9, 2026