PERSONAL PROJECT

SSH/Telnet Honeypot with Cowrie

Intrusion simulation and forensic log analysis on an isolated cybersecurity lab

Context

This project is part of a personal cybersecurity lab built on VMware Workstation Pro, with an attacker machine (Kali Linux) and a target machine (Debian) isolated on a dedicated virtual network (VMnet2), with no access to production networks or the Internet.

Goal: deploy an SSH/Telnet honeypot (Cowrie) on the target, simulate a realistic brute-force attack from the attacker machine, then thoroughly analyze the traces left behind.

Objectives

Deploy and configure Cowrie to emulate a vulnerable SSH service, redirecting the real SSH service to a non-standard port.
Run a realistic brute-force attack (Hydra) against the honeypot from the attacker machine.
Extract and analyze the JSON logs generated by Cowrie (typed commands, file download attempts).
Fully document the process, including incidents encountered, in a Notion knowledge base.

Project timeline

1
Honeypot setup
Installed Cowrie on the target, redirected port 22 to the honeypot via iptables and moved the real SSH service to port 2200, with persistent rules via iptables-persistent.
2
Major incident: lost access to the attacker machine
Locked out of the Kali Linux password with no usable recovery snapshot. Decided to fully reinstall the VM from the official image rather than attempt an uncertain recovery.
3
Brute-force attack
Launched Hydra against the honeypot. First attempt failed (default parallelism too high for Cowrie's Twisted-based SSH implementation), fixed by lowering the number of parallel tasks.
4
Forensic log analysis
Extracted JSON events with jq: commands typed by the simulated attacker, file download attempts, full session reconstruction.

Results

Passwords compromised: 3 / 3 tested
Attacker commands captured: 17
File download attempts: 0 (blocked, isolated target)
Restore snapshots: 2 (target + attacker)

Incident management

The most instructive part of this project was unplanned: a configuration mistake locked access to the attacker machine, with no usable snapshot to roll back to.

Rather than losing time on an uncertain recovery (failed GRUB single-user attempt), the VM was fully reinstalled from the official Kali image, network configuration and tooling restored, and the planned attack resumed. This incident is documented in detail in the project log, with a full timeline and remediation commands.

Stack and tools

Kali Linux (attacker) and Debian (target) on VMware Workstation Pro 17
Cowrie (SSH/Telnet honeypot, Python deployment via pip)
Hydra (brute-force attack)
iptables / iptables-persistent (port redirection, persistent rules)
jq (JSON log extraction and analysis)

Screenshots