Fool Hackers by deploying HoneyPot in your enterprise Network


HoneyPot is always a great way to fool hackers. There are many types of HoneyPot system, some are used to detect, deflect, or even counteract the hackers. Today we will talk about cross platform honeypot which can be used for enterprise information security. HFish is such a HoneyPot tool, using this tool we can detect the attacks in our networks and further analyze them. Earlier researchers of International Institute of Cyber Security demonstrated other ways to setup your own HoneyPot.

When we use this honeypot tool, it fools hackers by creating lucrative system for attack. If an hacker tries to hack the target, this honeypot tool captures the behavior of the attack and we can keep an eye on how hackers are targeting network with a vulnerabilities. Most of the organizations can use this tool, to find out the vulnerabilities through hackers.


  • OS: Kali Linux 2020 64 bit
  • Kernel-Version: 5.6.0

Installation Steps

  • Use this command to download the zip file.
  • wget
root@kali:/home/iicybersecurity# wget
--2020-08-10 11:56:57--
Resolving ( to (||:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: [following]
--2020-08-10 11:57:12--
Resolving (
Connecting to (||:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 14575783 (14M) [application/octet-stream]
Saving to: ‘HFish-0.6.2-linux-amd64.tar.gz’
HFish-0.6.2-linux-amd64.tar.gz             100%[========================================================================================>]  13.90M  3.64MB/s    in 5.0s
2020-08-10 11:57:18 (2.78 MB/s) - ‘HFish-0.6.2-linux-amd64.tar.gz’ saved [14575783/14575783]
  • Next, use this command to extract the zip file tar -zvfx <file name>
root@kali:/home/iicybersecurity# tar -zvxf HFish-0.6.2-linux-amd64.tar.gz
  • Use cd command to enter into HFish directory.
root@kali:/home/iicybersecurity/HFish# cd ..
root@kali:/home/iicybersecurity# cd HFish
  • Now, use this command to run the tool, ./HFish run
root@kali:/home/iicybersecurity/HFish-0.6.2-linux-amd64# ./HFish run
[GIN-debug] [WARNING] Running in "debug" mode. Switch to "release" mode in production.
 - using env:   export GIN_MODE=release
 - using code:  gin.SetMode(gin.ReleaseMode)
[GIN-debug] Loaded HTML Templates (2):
        - index.html
[GIN-debug] POST   /post/setting/updateWhiteIp --> HFish/view/setting.UpdateWhiteIp (7 handlers)
[GIN-debug] POST   /post/setting/updatePasswdTM --> HFish/view/setting.UpdatePasswdTM (7 handlers)
[GIN-debug] POST   /post/setting/clearData   --> HFish/view/setting.ClearData (7 handlers)
[GIN-debug] GET    /api/v1/get/ip            --> HFish/view/api.GetIpList (7 handlers)
[GIN-debug] GET    /api/v1/get/fish_info     --> HFish/view/api.GetFishInfo (7 handlers)
[GIN-debug] GET    /api/v1/get/passwd_list   --> HFish/view/api.GetAccountPasswdInfo (7 handlers)
pid is 32482020/08/10 11:58:16 Listening on [::]:5900
  • Next open this URL in our browser <SERVER-IP:9001>
HFish - Login Page
HFish – Login Page
  • Successfully we got the login page.
  • Now, enter admin as username and password to login.
  • HFish tool displays the attacks in two different ways
    • Numbers
    • Graph (Last 24 Hours)
HFish - DashBoard
HFish – DashBoard
  • As we can see some counters in services like SSH, Redis, Telnet. Here, all these counters incremented when somebody tries to hack into the HoneyPot system.
  • Now lets try to replicate a scenario by trying to hack into HoneyPot server.
  • Imagine a hacker who is tying to scan servers in your network, and finds a server with services like SSH, Telnet, FTP open. Hacker will first try to brute force the services running on server.
  • To brute force we will simply do telnet, ftp to vulnerable/honeypot IP address. Open cmd in windows and run:
    • telnet
    • FTP
  • Once somebody try to access open services, counter of the services on HoneyPot will increase.
  • In the same way, we also get logs in the terminal.
HFish - Logs
HFish – Logs
  • Services status: Here, we can see the attack details
HFish - Service Status
HFish – Service Status
  • In the status of the service, we have 4 different boxes
    • Attack Area: Here, it displays the attack area. So we have to imagine there is a vulnerability
    • Attack IP: Here, It shows the hacker’s IP address.
    • Account Statistics: Here, it shows the account’s user name, which hackers used.
    • Password Statistics: Here, it shows the passwords that hackers used.
  • We can view this data in big screen also
HFish - Big screen
HFish – Big screen


As we saw on how we can detected the attacks using HFish (Honeypot). Most of the organizations use this tool, to make hackers fool and find out vulnerabilities in the network.