The Honeynet Project

Mentors: Student: Krishna Awasthi

The goal of this project is to improve GreedyBear’s threat intelligence capabilities by incorporating honeypot payload files received from T-Pot. Currently, GreedyBear only receives and handles metadata such as IP addresses, ports, and credentials from Elasticsearch logs, while actual threat payloads received from honeypots remain unused and inaccessible to analysts . In this regard, this project proposes a secure end-to-end payload ingestion pipeline between T-Pot and GreedyBear. To achieve this, a FastAPI-based microservice will be deployed along with T-Pot to dynamically expose payload files and their associated metadata such as hashes and MIME types via authenticated APIs without altering existing honeypot functionality or imposing additional system overhead. On the GreedyBear end of the pipeline, a scheduled Django Q2 task will be implemented to fetch new payloads and securely store them in a quarantined environment while ensuring deduplication via cryptographic hashes and metadata indexing in PostgreSQL for easy retrieval via a REST API while imposing strict access controls to only allow authorized personnel to download payload files. Moreover, the system will also be designed to optionally share received payloads with MalwareBazaar to contribute to the threat intelligence community as well. In summary, this project aims to greatly improve GreedyBear’s threat intelligence and security analysis capabilities by not only ingesting threat indicators but also threat payloads to become a comprehensive threat intelligence platform for the organization and the entire threat intelligence community at large.

Mentors: Student: Haydar Amru Revanda

EventHorizon is a multi protocol IoT tarpit framework designed to trap automated network scanners. However, its current static deception mechanisms make the system predictable and allow scanners to fingerprint and evade the tarpit. This project solves this problem with a bio-inspired deception engine that adapts biological strategies such as camouflage, bluffing, and playing dead to low interaction IoT protocols. Furthermore, it modernizes the observability by migrating its telemetry to OpenTelemetry for cross-protocol trace correlation and structured data analysis.

Mentors: Student: sanjib2006

This project aims to harden IntelOwl's connector ecosystem - the critical egress layer for routing threat intelligence data by resolving Django ORM inefficiencies, task-safety mutability bugs in Celery workers, and false-positive health checks. The project will be executed by fixing core database and syntax bottlenecks, implementing native API diagnostics, and introducing a shared CTIConnector base class to de duplicate observable extraction logic. Finally, a lightweight dockerized CI testing pipeline will be established for the MISP connector to ensure long-term ecosystem stability.

Mentors: Student: Rafli Permana

Artemis currently requires all targets to go through the full discovery pipeline even when the HTTP endpoint is already known, lacks deep crawling capabilities, leaves non-CMS technology detection results unused, has no frontend authentication, and is missing detectors for several common vulnerability classes. This project addresses these gaps by enabling direct URL scanning to bypass unnecessary enumeration, replacing the single-page BeautifulSoup crawler with a Katana + uro + gf pipeline for deep crawling, making Wappalyzer's technology detection actionable through intelligent task routing to downstream modules, adding token auto-generation and session-based frontend authentication, and implementing three new vulnerability detectors: SSTI (via TInjA), OS command injection, and NoSQL injection (error-based). All work follows Artemis's existing Karton module conventions with no architectural changes required.

Mentors: Student: Vibe

DICOMHawk is an open-source honeypot that emulates a vulnerable DICOM medical imaging server to attract and log unauthorized access attempts. The current v3.0 rewrite is functional at the core protocol level but presents a single fixed identity, lacks a web interface, has incomplete DIMSE handler coverage, and performs no analysis on attacker-submitted payloads. This project transforms DICOMHawk into a profile-driven deception platform. A profile system allows the honeypot to impersonate different medical imaging systems through YAML-backed configuration, controlling the DICOM identity, web-facing surface, and honeytrap behavior per deployment. An attacker-facing web extension built with Flask exposes realistic viewer interfaces and honeytrap endpoints, while browser and environment fingerprinting collects telemetry about attacker infrastructure. On the protocol side, the project completes missing DIMSE handlers (associate, release, abort) and adds DICOMweb (QIDO-RS, WADO-RS, STOW-RS) endpoints. A structured logging pipeline with session correlation ties DICOM, web, and fingerprint events together. A static-analysis sandbox quarantines and analyzes uploaded payloads without execution, shipping with starter YARA rules. Finally, Docker deployment is hardened for safer operation. Deliverables: Profile-based architecture with two starter profiles, attacker-facing web extension with per-profile templates, operator Web API, browser fingerprinting with correlation database, completed DIMSE and DICOMweb handlers, unified JSON event logging with session correlation, static-analysis sandbox with YARA support, and hardened Docker deployment.