Skip to content
← Back to projects
SSH/Telnet Honeypot with Cowrie — cover image
Personal project

SSH/Telnet Honeypot with Cowrie

Intrusion simulation and forensic log analysis on an isolated cybersecurity lab

Context

This project is part of a personal cybersecurity lab built on VMware Workstation Pro, with an attacker machine (Kali Linux) and a target machine (Debian) isolated on a dedicated virtual network (VMnet2), with no access to production networks or the Internet.

Goal: deploy an SSH/Telnet honeypot (Cowrie) on the target, simulate a realistic brute-force attack from the attacker machine, then thoroughly analyze the traces left behind.

Objectives

  • Deploy and configure Cowrie to emulate a vulnerable SSH service, redirecting the real SSH service to a non-standard port.
  • Run a realistic brute-force attack (Hydra) against the honeypot from the attacker machine.
  • Extract and analyze the JSON logs generated by Cowrie (typed commands, file download attempts).
  • Fully document the process, including incidents encountered, in a Notion knowledge base.

Project timeline

  1. 1
    Honeypot setup
    I installed Cowrie on the target, redirected port 22 to the honeypot via iptables, and moved the real SSH service to port 2200, with persistent rules via iptables-persistent.
  2. 2
    Major incident: lost access to the attacker machine
    I got locked out of the Kali Linux password with no usable recovery snapshot. I decided to fully reinstall the VM from the official image rather than attempt an uncertain recovery.
  3. 3
    Brute-force attack
    I launched Hydra against the honeypot. My first attempt failed (default parallelism too high for Cowrie's Twisted-based SSH implementation); I fixed it by lowering the number of parallel tasks.
  4. 4
    Forensic log analysis
    I extracted JSON events with jq: commands typed by the simulated attacker, file download attempts, full session reconstruction.

Results

Passwords compromised
3 / 3 tested
Attacker commands captured
17
File download attempts
0 (blocked, isolated target)
Restore snapshots
2 (target + attacker)

Incident management

The most instructive part of this project was unplanned: a configuration mistake on my part locked me out of the attacker machine, with no usable snapshot to roll back to.

Rather than lose time on an uncertain recovery (a failed GRUB single-user attempt), I fully reinstalled the VM from the official Kali image, restored the network configuration and tooling, and resumed the planned attack. I documented this incident in detail in the project log, with a full timeline and remediation commands.

Stack and tools

  • Kali Linux (attacker) and Debian (target) on VMware Workstation Pro 17
  • Cowrie (SSH/Telnet honeypot, Python deployment via pip)
  • Hydra (brute-force attack)
  • iptables / iptables-persistent (port redirection, persistent rules)
  • jq (JSON log extraction and analysis)

Screenshots

SSH/Telnet Honeypot with Cowrie — screenshot 1 of 13
SSH/Telnet Honeypot with Cowrie — Aïcha Imène DAHOUMANE