Lion Cipher Lab
Set up an SSH honeypot with Cowrie
- SOC Analyst / Blue Team
- Beginner
- ~45 min
- Free · no account required
Why it matters
Reading logs after the fact tells you an attack happened. A honeypot lets you watch one unfold: a deliberate decoy that has no legitimate purpose, so every connection it receives is, by definition, someone poking at something that is not theirs. Cowrie records the usernames and passwords intruders try, the commands they run once they think they are in, and the files they try to download — the raw material of real attacker behaviour. Doing this yourself, once, on an isolated box turns "threats" from an abstraction into a log file with real IP addresses in it, and teaches the judgement a SOC…
What you'll learn
- what a honeypot is
- deploying Cowrie with Docker
- isolating a lab host
- reading honeypot logs
- recognising attacker behaviour
- the ethics and legality of running a decoy
Steps in this lab
- What a honeypot is — and the ground rules first
- Build the isolated lab host
- Pull and run Cowrie with Docker
- Knock on your own honeypot
- Watch attempts arrive, live
- Read the logs properly
- Read the behaviour, not just the lines
- Tear down, and keep the discipline