What Is a Honeypot?
A honeypot is an information system resource expressly set up to attract and trap people attempting to penetrate an organization's network. It has no authorized activity and no production value — so any traffic touching it is almost certainly a probe, attack, or compromise.
Why it's useful
A honeypot can log port-access attempts or monitor an attacker's keystrokes, giving defenders an early warning of a larger, more concerted attack — without risking real production assets.
Meanwhile, the real Web Server and Internal Network sit safely behind the firewall, isolated from what the honeypot is exposing to the attacker.
Mnemonic — What a Honeypot Is
"NO VALUE = ALL SUSPICIOUS" — a honeypot has zero legitimate business value, so unlike a real server, there is no such thing as "normal traffic" hitting it. Every single packet is a red flag by definition.
Honeypot Types — By Design (Interaction Level)
Honeypots are classified along a spectrum of how much real functionality they simulate.
Fewer services simulated → easier to deploy and safer, but attackers can often tell it's fake and less data is captured.
All services/apps simulated → very convincing, captures deep attacker behavior, but higher operational risk and effort to maintain.
Mnemonic — Interaction Ladder
"LOW < MEDIUM < HIGH < PURE" — climb the ladder from a cardboard cutout (Low: a few fake services) to a full-blown wax museum (Medium: real-looking OS/apps) to an actual functioning decoy building (High: everything simulated) to an exact clone of the real HQ (Pure: emulates the whole production network).
Honeypot Types — By Deployment Strategy
Deployed inside the organization's production network alongside other real production servers. Because they sit internally, they also help uncover internal flaws and attackers already inside the organization.
High-interaction honeypots primarily deployed by research institutes, governments, or military organizations to gain detailed knowledge about intruders' actions — intelligence-gathering, not day-to-day defense.
Production vs Research — the giveaway word
"Production" = protects a real business network day to day. "Research" = studies attackers for knowledge, typically run by research/government/military bodies and always high-interaction.
Honeypot Types — By Deception Technology
A finer-grained classification based on exactly what kind of bait is used.
Mnemonic — Six Deception Flavors
"MDSE-SH" → Malware, Database, Spam, Email, Spider, Honeynet. Think of six different fishing lures, each shaped to attract a specific type of fish (malware writers, SQL injectors, spammers, phishers, crawlers, or whole gangs of intruders via a full honeynet).
Honeypot Tools
| Tool | Notes |
|---|---|
| HoneyBOT | Medium-interaction honeypot for Windows; easy-to-use, ideal for network security research. |
| KFSensor | Commercial Windows honeypot IDS. |
| MongoDB-HoneyProxy | Honeypot proxy targeting MongoDB-style attacks. |
| Modern Honey Network | Framework for managing multiple honeypots centrally. |
| ESPot | Honeypot tool (open-source, GitHub). |
| HoneyPy | Low-interaction honeypot written in Python. |
What Are Proxy Servers?
A proxy server is a dedicated computer, or a software system, virtually located between a client and the actual server. It acts as a sentinel between an internal network and the open internet.
| # | What a proxy server does |
|---|---|
| 01 | Sits virtually between client and actual server. |
| 02 | Acts as a sentinel between an internal network and the open internet. |
| 03 | Serves client requests on behalf of actual servers, preventing them from exposing themselves directly to the outside world. |
| 04 | Adds an extra layer of defense, protecting against certain OS- and web-server-specific attacks. |
| 05 | Lets security teams intercept malicious/offensive web content, viruses, etc. hidden in client requests. |
Benefits of a Proxy Server
1
Acts as a security protector between user devices and a server.
2
Enhances the security and privacy of client devices.
3
Improves browsing speed (via caching).
4
Provides advanced logging capabilities for user activities.
5
Controls access to specific restricted services.
6
Hides internal IP addresses and filters requests from external sites.
7
Reduces the chances of modifying cookies in the browser configuration.
8
Enables authentication for the proxy server before handling user requests.
Functioning of a Proxy Server
Internal host requests a website
The client sends a request to reach an external site.
Proxy inspects it
The request enters the proxy server, which examines the header and packet content based on a rule base.
Packet is reconstructed
The proxy server reconstructs the data packet using a different source IP address (its own).
Packet transmitted onward
The proxy transmits the packet to the target address, concealing the actual end user who made the request.
Return packet re-checked
If a reply comes back, it's again sent to the proxy server and checked against the rule base.
Reconstructed and delivered
The proxy reconstructs the returned packet and sends it to the original requesting source computer.
PC 1 (192.168.2.3) on the internal network requests a Facebook page (registered IP 55.24.411.16). The request goes: internal PC → firewall → proxy server (external interface 24.67.233.7, internal address 66.44.512.128) → internet → Facebook. The reply is forwarded by the proxy back to the requesting client — Facebook only ever sees the proxy's IP, never PC 1's real private address.
Proxy Servers vs Packet Filters
Examine the full data payload of the packet. Create detailed log listings since they scan the entire IP packet's data. Restructure the packet with a new source IP. If the proxy server fails, all network communications cease.
Only examine routing information (headers) of the packet. Log only header information. Simply allow or block data based on filter rules. If a packet filter fails, packets may still be allowed through the internal network.
Mnemonic — Proxy vs Packet Filter Failure
"PROXY FAILS CLOSED, FILTER FAILS OPEN" — if the proxy dies, the whole road is blocked (no traffic at all). If the packet filter dies, the gate is left wide open (traffic may pass unchecked). This "fail closed vs fail open" contrast is a favorite exam trap.
Types of Proxy Servers
Five named proxy types appear in the slides: Transparent, Non-Transparent, SOCKS, Anonymous, and Reverse.
Transparent Proxy
A proxy through which a client system connects to a server without its knowledge. It's configured to be entirely invisible to the end user. Important nuance from the slides: with a transparent proxy, all web clients must still be configured manually (despite being "invisible" in terms of the connection process).
Non-Transparent Proxy
Requires client software to be configured to use the proxy server — the client is made aware of the proxy's existence. Harder to set up because each client program must be individually configured to route requests to a single port. Four functional areas: Group Annotation Services, Media Type Transformation, Protocol Reduction, Anonymity Filtering.
SOCKS Proxy
An IETF (Internet Engineering Task Force) standard. Unlike a caching HTTP proxy, SOCKS does not have special caching abilities. It also prevents external network components from collecting information about the client that generated the request. The SOCKS package includes: a SOCKS server for the specified OS, a client program (FTP, Telnet, browser), and a client library for SOCKS.
Anonymous Proxy
Does not transfer information about the user's IP address, hiding both the user's identity and their surfing interests.
Private browsing; can access even censored websites.
May decrease page-load speed; using it to bypass internet censorship is illegal in some countries.
Reverse Proxy
Situated closer to the server(s); returns only a configured set of resources. Can optimize content by compressing it to speed up loading. The client is unaware of the reverse proxy's presence. Sits between a client and the actual web server — but protects the server side, unlike a forward proxy which protects the client side.
Mnemonic — Forward vs Reverse Proxy Direction
"FORWARD PROTECTS THE CLIENT, REVERSE PROTECTS THE SERVER" — a regular/forward proxy (transparent, non-transparent, SOCKS, anonymous) sits near the client hiding who's asking. A reverse proxy sits near the server, hiding what's actually answering.
How to Configure a Proxy Server
Automatic Proxy Setup — Windows 10
Open Settings
Press Windows key + I.
Network & Internet → Proxy
Navigate to the Proxy section.
Check "Automatically detect settings"
Verify the toggle is On.
Windows runs an automatic check
By default.
If a PAC file is detected
Set "Use Setup Script" toggle to On.
Enter script address
Type proxy.certifiedhacker.com in the Script Address field.
Save
Click Save to implement changes and use the internet through the proxy.
Manual Proxy Setup — Windows 10
Open Settings
Windows key + I.
Network & Internet → Proxy
Navigate there.
Scroll to Manual proxy setup
Set "Use a Proxy Server" toggle to On.
Enter address and port
Type proxy.certifiedhacker.com in the address field, 8888 in the port field.
Add exemptions
Type *.local below the address/port fields to exempt local addresses from the proxy.
Save
Click Save to implement and use the proxy in Windows 10.
Settings → scroll to Advanced → System → "Open your computer's proxy settings" → follow OS instructions.
Settings (top-right menu) → scroll to System → "Open your computer's proxy settings" → follow the proxy server setup instructions.
Limitations of Proxy Servers
| # | Limitation |
|---|---|
| 1 | If not properly secured, the proxy can become a single point of failure during an attack. |
| 2 | Increases workload — the proxy must be configured for every service it provides. |
| 3 | Changing default settings may break the proxy's functionality. |
| 4 | Proxies must reroute information, so web pages can sometimes load slowly. |
| 5 | If the proxy tries to bypass suspicious software, some page elements may fail to load. |
Squid is a caching proxy for the web, supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response time by caching and reusing frequently requested web pages.
List of Proxy Tools
| Tool | Tool | Tool |
|---|---|---|
| Whonix | Proxify | ProxyCap |
| Psiphon | Guardster | CCProxy |
| FoxyProxy | Global Proxy Network | Fiddler |
| GeoSurf | Anonym8 | BlackArch Proxy |
| JonDo | ProxySite | Artica Proxy |
Exam Tips & Tricks
Honeypot has zero value by design
Any traffic to a honeypot is inherently suspicious — there's no legitimate reason to touch it.
Three honeypot classification axes
Interaction level (low/medium/high/pure), deployment strategy (production/research), and deception technology (malware/database/spam/email/spider/honeynet) — three separate ways to categorize the same honeypot.
Research honeypots are always high-interaction
Don't confuse the deployment-strategy axis with the interaction-level axis — research honeypots specifically use high-interaction to gather deep intel.
Proxy failure ≠ packet filter failure
Proxy down = all comms cease. Packet filter down = traffic may still pass. Classic contrast question.
Transparent proxy still needs client config
"Invisible" refers to the connection process, not to setup — clients must still be configured manually per the slides.
Reverse proxy sits near the server
All other proxy types sit near the client. Reverse proxy is the odd one out — it protects the server, not the requester.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Honeypot | Decoy system with no production value, set up to attract/trap attackers and log their activity. |
| Low-Interaction Honeypot | Simulates a limited number of services/apps. |
| Medium-Interaction Honeypot | Simulates a real OS, applications, and services. |
| High-Interaction Honeypot | Simulates ALL services/applications of a target network. |
| Pure Honeypot | Emulates the entire real production network of the organization. |
| Production Honeypot | Deployed inside the production network; helps find internal flaws/attackers. |
| Research Honeypot | High-interaction; used by research/government/military to study intruders. |
| Malware Honeypot | Traps malware campaigns/attempts. |
| Database Honeypot | Fake vulnerable DB attracting SQLi/enumeration attacks. |
| Spam Honeypot | Targets spammers abusing open mail relays/proxies. |
| Email Honeypot | Fake email addresses attracting malicious emails. |
| Spider Honeypot | Traps web crawlers/spiders. |
| Honeynet | Network of honeypots; reveals full adversary capabilities. |
| Honeypot Tools | HoneyBOT, KFSensor, MongoDB-HoneyProxy, Modern Honey Network, ESPot, HoneyPy. |
| Proxy Server | Sits between client and server; sentinel that hides real servers from the outside world. |
| Proxy Benefits | Security, privacy, speed (caching), logging, access control, IP hiding, cookie protection, authentication. |
| Proxy Functioning | Request enters proxy → inspected vs rule base → repackaged with new source IP → sent onward → reply re-checked → delivered to client. |
| Proxy vs Packet Filter | Proxy reads full payload & fails closed; packet filter reads headers only & fails open. |
| Transparent Proxy | Client connects without knowing; invisible to user; still requires manual client configuration. |
| Non-Transparent Proxy | Client software must be configured; client is aware; harder to set up per-program. |
| SOCKS Proxy | IETF standard; no caching; hides client info from external components; includes server, client program, client library. |
| Anonymous Proxy | Hides user's IP/surfing interests; pro: privacy/censorship bypass; con: slower, sometimes illegal. |
| Reverse Proxy | Sits near the server; returns limited resources; can compress content; client unaware of its presence. |
| Configuring Proxy (Windows 10) | Settings → Network & Internet → Proxy → automatic (PAC script) or manual (address+port, exemptions) → Save. |
| Proxy Limitations | Single point of failure, added workload, breaks if defaults changed, slower page loads, may block page elements. |
| Squid Proxy | Caching proxy supporting HTTP/HTTPS/FTP; reduces bandwidth via caching frequently requested pages. |
| Proxy Tools | Whonix, Proxify, ProxyCap, Psiphon, Guardster, CCProxy, FoxyProxy, Fiddler, JonDo, ProxySite, Artica Proxy, and more. |