{"id":125,"date":"2025-03-23T00:09:03","date_gmt":"2025-03-23T00:09:03","guid":{"rendered":"http:\/\/wickenfix.it\/?p=125"},"modified":"2025-07-08T22:39:46","modified_gmt":"2025-07-08T21:39:46","slug":"building-a-tpot-honeypot","status":"publish","type":"post","link":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/","title":{"rendered":"Building a Honeypot on a Raspberry Pi"},"content":{"rendered":"\n<div class=\"wp-block-group alignwide is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-vertical is-content-justification-stretch is-layout-flex wp-container-core-group-is-layout-2a24861a wp-block-group-is-layout-flex\" style=\"border-top-color:var(--wp--preset--color--accent-6);border-top-width:1px;padding-top:var(--wp--preset--spacing--40);padding-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:66.66%\">\n<p>A Honeypot is a server which attempts to mimic a real device in an attempt to lure malicious actors into hacking it. This provides useful real-life threat data and information into the types of attacks being conducted in the wild.<br><br>By making a honeypot similar to a service you provide, the data collected by the honeypot, such as IP addresses, tactics etc, can be used to harden the defenses around the legitimate services you provide.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-a89b3969 wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"#tutorial\">Skip to the tutorial&#8230;<\/a><\/div>\n<\/div>\n\n\n\n<p>I will be using the open-source software &#8216;t-pot&#8217;. It allows you to deploy and manage multiple honeypots of different types, while bundling some great pre-configured monitoring tools. This guide covers how to build and configure t-pot on a Raspberry Pi.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:33.33%\">\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"720\" src=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png\" alt=\"\" class=\"wp-image-130\" srcset=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png 1280w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q-300x169.png 300w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q-1024x576.png 1024w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q-768x432.png 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><\/figure>\n\n\n\n<p><strong>Pre-requisites:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A Raspberry Pi 4 or 5 (Minimum 8GB RAM)<\/li>\n\n\n\n<li>M.2 NVMe SSD (Recommended) or an SD Card (Minimum 128GB)<\/li>\n\n\n\n<li>If you&#8217;re using an M.2 SSD, you&#8217;ll need an M.2 caddy &amp; an M.2 Hat.<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading has-xx-large-font-size\" id=\"tutorial\">Tutorial<\/h2>\n\n\n\n<p>Once you have the pre-requisites covered:<\/p>\n\n\n\n<div style=\"height:var(--wp--preset--spacing--30)\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-group is-vertical is-content-justification-stretch is-layout-flex wp-container-core-group-is-layout-2a24861a wp-block-group-is-layout-flex\" style=\"border-top-color:var(--wp--preset--color--accent-6);border-top-width:1px;padding-top:var(--wp--preset--spacing--40);padding-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:40%\">\n<h3 class=\"wp-block-heading\">Step 1: Install an OS<\/h3>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:60%\">\n<div class=\"wp-block-columns is-not-stacked-on-mobile is-layout-flex wp-container-core-columns-is-layout-7255d826 wp-block-columns-is-layout-flex\" style=\"margin-top:var(--wp--preset--spacing--40);margin-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>First, we need to image our Raspberry Pi. <\/p>\n\n\n\n<p>Download the Raspberry Pi imager:<\/p>\n\n\n\n<p><a href=\"https:\/\/downloads.raspberrypi.org\/imager\/imager_latest.exe\">https:\/\/downloads.raspberrypi.org\/imager\/imager_latest.exe<\/a><\/p>\n\n\n\n<p>Once downloaded, run the installer and open the application.<\/p>\n\n\n\n<p>Select the following options based on your hardware:<\/p>\n\n\n\n<p><strong>Raspberri Pi Device: <\/strong>The Pi version you are using (4 or 5)<br><strong>Operating System: <\/strong>Ubuntu Server 24.04 LTS (64-BIT)<br><strong>Storage: <\/strong>The SD Card\/M.2 in caddy.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"676\" height=\"478\" src=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-16.png\" alt=\"\" class=\"wp-image-185\" srcset=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-16.png 676w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-16-300x212.png 300w\" sizes=\"auto, (max-width: 676px) 100vw, 676px\" \/><\/figure>\n\n\n\n<p>When you select &#8216;next&#8217;, you will be asked if you&#8217;d like to pre-apply certain settings. This will allow you to skip the Out-of-Box-Experience (OOBE) and pre-configure username, password and network settings. Most importantly, you can enable SSH.<\/p>\n\n\n\n<p>Next, wait the image to write to the storage device.<\/p>\n\n\n\n<p>Once Ubuntu server has successfully installed, log in, either through SSH or keyboard &amp; mouse, and run the following command to bring the device up to date:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update &amp;&amp; sudo apt upgrade -y<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-vertical is-content-justification-stretch is-layout-flex wp-container-core-group-is-layout-2a24861a wp-block-group-is-layout-flex\" style=\"border-top-color:var(--wp--preset--color--accent-6);border-top-width:1px;padding-top:var(--wp--preset--spacing--40);padding-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:40%\">\n<h3 class=\"wp-block-heading\">Step 2: Installing T-Pot<\/h3>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:60%\">\n<div class=\"wp-block-columns is-not-stacked-on-mobile is-layout-flex wp-container-core-columns-is-layout-7255d826 wp-block-columns-is-layout-flex\" style=\"margin-top:var(--wp--preset--spacing--40);margin-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>To install T-Pot, clone the T-Pot CE Git Repository:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>git clone https:\/\/github.com\/telekom-security\/tpotce<\/code><\/pre>\n<\/div>\n<\/div>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"765\" height=\"156\" src=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-15.png\" alt=\"\" class=\"wp-image-168\" srcset=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-15.png 765w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-15-300x61.png 300w\" sizes=\"auto, (max-width: 765px) 100vw, 765px\" \/><\/figure>\n\n\n\n<p>If you do not have git installed, install it with <code>sudo apt install git<\/code><\/p>\n\n\n\n<p>Navigate to the newly created directory:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd tpotce<\/code><\/pre>\n\n\n\n<p>Use the <code>install.sh <\/code>script to install tpot:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/install.sh<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"190\" src=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-20.png\" alt=\"\" class=\"wp-image-203\" srcset=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-20.png 618w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-20-300x92.png 300w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/><\/figure>\n\n\n\n<p>The script will require you to provide information about the server, as well as configure a username and password which will be used later.<\/p>\n\n\n\n<p><strong>Note: <\/strong>Once you run this script, the SSH port will have changed from <code>22<\/code> to <code>64295<\/code>, this is to allow SSH honeypots to use that port instead. To SSH to the server from now on, you will need to specify this new port. For example, the PowerShell syntax is this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh &lt;user&gt;@&lt;IP Address&gt; -p 64295<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-vertical is-content-justification-stretch is-layout-flex wp-container-core-group-is-layout-2a24861a wp-block-group-is-layout-flex\" style=\"border-top-color:var(--wp--preset--color--accent-6);border-top-width:1px;padding-top:var(--wp--preset--spacing--40);padding-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:40%\">\n<h3 class=\"wp-block-heading\">Step 3: Creating a custom compose file<\/h3>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:60%\">\n<div class=\"wp-block-columns is-not-stacked-on-mobile is-layout-flex wp-container-core-columns-is-layout-7255d826 wp-block-columns-is-layout-flex\" style=\"margin-top:var(--wp--preset--spacing--40);margin-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>By default, T-Pot will have every possible honeypot running when you start the server after installing the software. This is not only very resource intensive , but also pointless. Not only will multiple honeypots be running that you won&#8217;t want or need, but some honeypots will be attempting to bind to the same port.<\/p>\n\n\n\n<p>To fix this, we need to customise the docker-compose.yml file. Luckily there is a handy script to help us do this. Navigate to the compose folder:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd compose<\/code><\/pre>\n\n\n\n<p>Run the customisation script:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>python3 customizer.py<\/code><\/pre>\n\n\n\n<p>This will take you though all the possible honeypot names and ask if you want to include them. <em>(Some will be required as they form part of the system, such as elasticsearch and kibana)<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"261\" src=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-19-1024x261.png\" alt=\"\" class=\"wp-image-202\" srcset=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-19-1024x261.png 1024w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-19-300x76.png 300w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-19-768x196.png 768w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-19.png 1087w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>The names will not mean much, however each one is listed in this GitHub repo:<\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/telekom-security\/tpotce?tab=readme-ov-file#honeypots-and-tools\">GitHub &#8211; telekom-security\/tpotce: \ud83c\udf6f T-Pot &#8211; The All In One Multi Honeypot Platform \ud83d\udc1d<\/a><\/p>\n\n\n\n<p>Some highlights that I have tested are:<\/p>\n\n\n\n<p><strong>Cowrie<\/strong> &#8211; An SSH honeypot that presents attackers with three failed logon attempts to gather credentials, and then provides a fake shell which collects all the commands entered and any downloads performed.<\/p>\n\n\n\n<p><strong>Wordpot &#8211; <\/strong>A fake WordPress honeypot which not only provides a false wp-admin logon screen, but also hosts an &#8216;xmlrpc.php&#8217; file and other wordpress related artifacts.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-vertical is-content-justification-stretch is-layout-flex wp-container-core-group-is-layout-2a24861a wp-block-group-is-layout-flex\" style=\"border-top-color:var(--wp--preset--color--accent-6);border-top-width:1px;padding-top:var(--wp--preset--spacing--40);padding-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:40%\">\n<h3 class=\"wp-block-heading\">Step 4: Using the custom file<\/h3>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:60%\">\n<div class=\"wp-block-columns is-not-stacked-on-mobile is-layout-flex wp-container-core-columns-is-layout-7255d826 wp-block-columns-is-layout-flex\" style=\"margin-top:var(--wp--preset--spacing--40);margin-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>To use the custom compose file we just made, we need to replace the current file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mv docker-compose-custom.yml ..\/docker-compose.yml<\/code><\/pre>\n\n\n\n<p>This will move the custom file back one directory, and re-name it to the correct file name as expected by T-Pot.<\/p>\n\n\n\n<p>Now, when you reboot the server, only the containers you selected should be running. You can check which containers are currently running using the docker command <code>dps <\/code>as I did below:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"247\" src=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-21-1024x247.png\" alt=\"\" class=\"wp-image-204\" srcset=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-21-1024x247.png 1024w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-21-300x72.png 300w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-21-768x185.png 768w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-21.png 1279w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Even though I&#8217;m only using <code>cowrie<\/code> and <code>wordpot<\/code>, the other containers are all required to provide the dashboards, database, maps and more.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-vertical is-content-justification-stretch is-layout-flex wp-container-core-group-is-layout-2a24861a wp-block-group-is-layout-flex\" style=\"border-top-color:var(--wp--preset--color--accent-6);border-top-width:1px;padding-top:var(--wp--preset--spacing--40);padding-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:40%\">\n<h3 class=\"wp-block-heading\">Step 5: Using the web GUI<\/h3>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:60%\">\n<div class=\"wp-block-columns is-not-stacked-on-mobile is-layout-flex wp-container-core-columns-is-layout-7255d826 wp-block-columns-is-layout-flex\" style=\"margin-top:var(--wp--preset--spacing--40);margin-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>Access the web GUI by visiting the IP address of your server on port <code>64297<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:\/\/&lt;IP ADDRESS&gt;:64297<\/code><\/pre>\n\n\n\n<p>This will prompt you to enter the username and password you set during the initial install. Once logged in, a screen will greet you with the following options:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"850\" height=\"550\" src=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-22.png\" alt=\"\" class=\"wp-image-205\" srcset=\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-22.png 850w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-22-300x194.png 300w, https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/image-22-768x497.png 768w\" sizes=\"auto, (max-width: 850px) 100vw, 850px\" \/><\/figure>\n\n\n\n<p>The left hand side is all of the tools at your disposal.<\/p>\n\n\n\n<p><strong>Attack Map &#8211; <\/strong>A live and dynamic map showing all incoming attacks.<br><strong>Cyberchef &#8211; <\/strong>A locally hosted copy of Cyberchef.<br><strong>Elasticvue &#8211; <\/strong>A place to perform in-depth queries into the data collected.<br><strong>Kibana &#8211; <\/strong>Full of pre-configured dashboards displaying useful data.<br><strong>Spiderfoot &#8211; <\/strong>A local hosted scanning utility.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-vertical is-content-justification-stretch is-layout-flex wp-container-core-group-is-layout-2a24861a wp-block-group-is-layout-flex\" style=\"border-top-color:var(--wp--preset--color--accent-6);border-top-width:1px;padding-top:var(--wp--preset--spacing--40);padding-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:40%\">\n<h3 class=\"wp-block-heading\">Step 6: Configure NAT\/Port forwarding<\/h3>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-top is-layout-flow wp-block-column-is-layout-flow\" style=\"flex-basis:60%\">\n<div class=\"wp-block-columns is-not-stacked-on-mobile is-layout-flex wp-container-core-columns-is-layout-7255d826 wp-block-columns-is-layout-flex\" style=\"margin-top:var(--wp--preset--spacing--40);margin-bottom:var(--wp--preset--spacing--40)\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p>Now that the Honeypots are configured, you need to actually expose them to the internet (scary stuff).<\/p>\n\n\n\n<p><strong>You need to be very careful doing this, as exposing the wrong IP address or Port could leave you vulnerable to real attacks.<\/strong><\/p>\n\n\n\n<p>To expose the honeypots and start collecting data, you need to use Network Address Translation (NAT) or Port Forwarding rules. This allows the attackers external IP addresses to be able to access your honeypot using your external IP address.<\/p>\n\n\n\n<p>How to do this will depend on the device and will require research if you haven&#8217;t done it before, but the rules will follow the below logic with SSH as an example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Connections from any to port 22, forward to &lt;honeypot IP&gt; port 22<\/code><\/pre>\n\n\n\n<p>Once implemented, log into T-pot and check for incoming data.<\/p>\n\n\n\n<p><strong>Again, this is very dangerous, it is highly recommended that the honeypot is on an isolated network that cannot connect to your other internal assets.<\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A Honeypot is a server which attempts to mimic a real device in an attempt to lure malicious actors into hacking it. This provides useful real-life threat data and information into the types of attacks being conducted in the wild. By making a honeypot similar to a service you provide, the data collected by the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-125","post","type-post","status-publish","format-standard","hentry","category-guides"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Building a Honeypot on a Raspberry Pi - wickenfix.it<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Building a Honeypot on a Raspberry Pi - wickenfix.it\" \/>\n<meta property=\"og:description\" content=\"A Honeypot is a server which attempts to mimic a real device in an attempt to lure malicious actors into hacking it. This provides useful real-life threat data and information into the types of attacks being conducted in the wild. By making a honeypot similar to a service you provide, the data collected by the [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/\" \/>\n<meta property=\"og:site_name\" content=\"wickenfix.it\" \/>\n<meta property=\"article:published_time\" content=\"2025-03-23T00:09:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-08T21:39:46+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png\" \/>\n<meta name=\"author\" content=\"matt\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"matt\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/\"},\"author\":{\"name\":\"matt\",\"@id\":\"https:\/\/wickenfix.it\/#\/schema\/person\/b57f92b7c9415dbb605e843355e7cb1b\"},\"headline\":\"Building a Honeypot on a Raspberry Pi\",\"datePublished\":\"2025-03-23T00:09:03+00:00\",\"dateModified\":\"2025-07-08T21:39:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/\"},\"wordCount\":985,\"publisher\":{\"@id\":\"https:\/\/wickenfix.it\/#organization\"},\"image\":{\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png\",\"articleSection\":[\"Guides\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/\",\"url\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/\",\"name\":\"Building a Honeypot on a Raspberry Pi - wickenfix.it\",\"isPartOf\":{\"@id\":\"https:\/\/wickenfix.it\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png\",\"datePublished\":\"2025-03-23T00:09:03+00:00\",\"dateModified\":\"2025-07-08T21:39:46+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#primaryimage\",\"url\":\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png\",\"contentUrl\":\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/wickenfix.it\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Building a Honeypot on a Raspberry Pi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/wickenfix.it\/#website\",\"url\":\"https:\/\/wickenfix.it\/\",\"name\":\"wickenfix.it\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/wickenfix.it\/#organization\"},\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/wickenfix.it\/#organization\",\"name\":\"wickenfix.it\",\"url\":\"https:\/\/wickenfix.it\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/wickenfix.it\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/cropped-Picture1.png\",\"contentUrl\":\"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/cropped-Picture1.png\",\"width\":512,\"height\":512,\"caption\":\"wickenfix.it\"},\"image\":{\"@id\":\"https:\/\/wickenfix.it\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/wickenfix.it\/#\/schema\/person\/b57f92b7c9415dbb605e843355e7cb1b\",\"name\":\"matt\",\"sameAs\":[\"http:\/\/10.0.200.10\"],\"url\":\"https:\/\/wickenfix.it\/index.php\/author\/matt\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Building a Honeypot on a Raspberry Pi - wickenfix.it","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/","og_locale":"en_GB","og_type":"article","og_title":"Building a Honeypot on a Raspberry Pi - wickenfix.it","og_description":"A Honeypot is a server which attempts to mimic a real device in an attempt to lure malicious actors into hacking it. This provides useful real-life threat data and information into the types of attacks being conducted in the wild. By making a honeypot similar to a service you provide, the data collected by the [&hellip;]","og_url":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/","og_site_name":"wickenfix.it","article_published_time":"2025-03-23T00:09:03+00:00","article_modified_time":"2025-07-08T21:39:46+00:00","og_image":[{"url":"http:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png","type":"","width":"","height":""}],"author":"matt","twitter_card":"summary_large_image","twitter_misc":{"Written by":"matt","Estimated reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#article","isPartOf":{"@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/"},"author":{"name":"matt","@id":"https:\/\/wickenfix.it\/#\/schema\/person\/b57f92b7c9415dbb605e843355e7cb1b"},"headline":"Building a Honeypot on a Raspberry Pi","datePublished":"2025-03-23T00:09:03+00:00","dateModified":"2025-07-08T21:39:46+00:00","mainEntityOfPage":{"@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/"},"wordCount":985,"publisher":{"@id":"https:\/\/wickenfix.it\/#organization"},"image":{"@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#primaryimage"},"thumbnailUrl":"http:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png","articleSection":["Guides"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/","url":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/","name":"Building a Honeypot on a Raspberry Pi - wickenfix.it","isPartOf":{"@id":"https:\/\/wickenfix.it\/#website"},"primaryImageOfPage":{"@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#primaryimage"},"image":{"@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#primaryimage"},"thumbnailUrl":"http:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png","datePublished":"2025-03-23T00:09:03+00:00","dateModified":"2025-07-08T21:39:46+00:00","breadcrumb":{"@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#primaryimage","url":"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png","contentUrl":"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/0_PJiT0S2WqBqFLH1q.png","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/wickenfix.it\/index.php\/building-a-tpot-honeypot\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/wickenfix.it\/"},{"@type":"ListItem","position":2,"name":"Building a Honeypot on a Raspberry Pi"}]},{"@type":"WebSite","@id":"https:\/\/wickenfix.it\/#website","url":"https:\/\/wickenfix.it\/","name":"wickenfix.it","description":"","publisher":{"@id":"https:\/\/wickenfix.it\/#organization"},"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/wickenfix.it\/#organization","name":"wickenfix.it","url":"https:\/\/wickenfix.it\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/wickenfix.it\/#\/schema\/logo\/image\/","url":"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/cropped-Picture1.png","contentUrl":"https:\/\/wickenfix.it\/wp-content\/uploads\/2025\/03\/cropped-Picture1.png","width":512,"height":512,"caption":"wickenfix.it"},"image":{"@id":"https:\/\/wickenfix.it\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/wickenfix.it\/#\/schema\/person\/b57f92b7c9415dbb605e843355e7cb1b","name":"matt","sameAs":["http:\/\/10.0.200.10"],"url":"https:\/\/wickenfix.it\/index.php\/author\/matt\/"}]}},"_links":{"self":[{"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/posts\/125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/comments?post=125"}],"version-history":[{"count":22,"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/posts\/125\/revisions"}],"predecessor-version":[{"id":209,"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/posts\/125\/revisions\/209"}],"wp:attachment":[{"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/media?parent=125"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/categories?post=125"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wickenfix.it\/index.php\/wp-json\/wp\/v2\/tags?post=125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}