CyberPot - The All-in-One Multi Honeypot Platform

TL;DR

1. ✅ Meet system requirements. CyberPot needs at least 8-16 GB RAM, 128 GB free disk space, and a working internet connection.
2. 📦 Choose your distro or use a running, supported distribution.
3. 🐳 Install Docker + Docker Compose.
4. 🚀 Run installer: ./install.sh
5. 🔄 Reboot & login

Technical Architecture

CyberPot technical architecture - compose templates, docker images, and service topology

Core Concept

CyberPot is the all-in-one, optionally distributed, multi-architecture (amd64, arm64) honeypot platform supporting 20+ honeypots with Elastic Stack visualization, live attack maps, and security tools for enhanced deception experience.

• 📦 23+ honeypots - conpot, cowrie, dionaea, ddospot, honeytrap, and more
• 📊 Elastic Stack - Elasticsearch, Logstash, Kibana, Elasticvue
• 🗺️ Attack Map - Animated threat visualization
• 🕵️ Spiderfoot - OSINT automation
• 🔧 25+ tools - CyberChef, P0f, Suricata, Fatt, and more

System Requirements

CyberPot Type	RAM	Storage	Description
Hive	16 GB	256 GB SSD	Full hive with all services & honeypots
Sensor	8 GB	128 GB SSD	Honeypots + tools, sends data to HIVE
Standalone	8 GB	128 GB SSD	Single host with all features

Requirement	Specification
IPv4 address	DHCP or static
Internet	Non-proxied, outgoing
OS	AlmaLinux 9, Debian 12, Fedora 40, OpenSuse Tumbleweed, Rocky Linux 9, Ubuntu 24.04
Distro (ARM)	Raspberry Pi 4 (8GB), Apple Silicon

Running in a VM

Supported VM platforms:

• UTM (Intel & Apple Silicon)
• VirtualBox
• VMWare Fusion/Workstation
• KVM (reported working)

Apple Silicon note: may require switching to Console Only display mode during initial install.

Required Ports

Port	Protocol	Direction	Description
80, 443	tcp	outgoing	Management: updates, logs
64294	tcp	incoming	Sensor data transmission
64295	tcp	incoming	SSH access
64297	tcp	incoming	NGINX reverse proxy
5555	tcp	incoming	ADBHoney honeypot
5000	udp	incoming	CiscoASA honeypot
8443	tcp	incoming	CiscoASA honeypot
443	tcp	incoming	CitrixHoneypot
80, 102, 502, 1025...	tcp	incoming	Conpot honeypot
22, 23	tcp	incoming	Cowrie honeypot
19, 53, 123, 1900	udp	incoming	Ddospot honeypot
9200	tcp	incoming	Elasticpot
6379	tcp	incoming	Redishoneypot
8090	tcp	incoming	Wordpot honeypot

Choose your distro

Distribution	x64	arm64
AlmaLinux 9.4	download	download
Debian 12	download	download
Fedora Server 40	download	download
OpenSuse Tumbleweed	download	download
Rocky Linux 9.4	download	download
Ubuntu 24.04	download	download
Raspberry Pi OS	-	download

Installation Types

Standard / HIVE

All services, tools, honeypots installed on single host acting as HIVE endpoint. Adjust docker-compose.yml or use composer.py for customization.

Distributed

Requires HIVE (standard installation) + SENSOR (honeypots + tools only, transmits data to HIVE).

Installation

git clone https://github.com/khulnasoft/cyberpot
cd cyberpot
./install.sh

Follow prompts, reboot, then login via SSH (tcp/64295) or WebUI (https://IP:64297).

First Start

After reboot, login and verify via dps.sh. Access:

• WebUI: https://<ip>:64297 (user: <WEB_USER>)
• Kibana: On landing page, select tailored dashboards
• Attack Map: On landing page, requires credential re-entry
• Elasticvue: On landing page

Remote Access & Tools

Service	Access
SSH	ssh -l <OS_USERNAME> -p 64295 <ip>
WebUI	https://<ip>:64297
Kibana	Landing page → Kibana
Attack Map	Landing page → Map
CyberChef	Landing page → CyberChef
Elasticvue	Landing page → Elasticvue
Spiderfoot	Landing page → Spiderfoot

Configuration

CyberPot Config File

Configuration in ~/cyberpot/.env (hidden) and env.example (defaults). Key variables:

• CYBERPOT_REPO - Docker repository
• CYBERPOT_VERSION - Version (24.04.2)
• CYBERPOT_PULL_POLICY - always|missing|never|build
• CYBERPOT_TYPE - HIVE|SENSOR|MOBILE
• CYBERPOT_OSTYPE - linux|mac|win

Customize Honeypots & Services

1. Stop: systemctl stop cyberpot
2. Copy preset: cp compose/standard.yml ./docker-compose.yml
3. Customize: python3 compose/customizer.py
4. Replace: mv docker-compose-custom.yml ./docker-compose.yml
5. Start: systemctl start cyberpot

Maintenance

Action	Command
General Updates	./update.sh -y
Daily Reboot	sudo crontab -e (add: 42 2 * * * systemctl stop cyberpot && docker container prune -f...)
Show Containers	dps or dpsw [interval]
Factory Reset	sudo rm -rf ~/cyberpot/data && git reset --hard
Log Persistence	30 days default (adjust in Kibana ILP)

Badges & Shields

Contact

• 🐛 Issues
• 💬 Discussions
• 📦 GitHub Packages
• 🐦 Twitter

CyberPot Landing Page - WebUI

Elastic Stack visualization

Live threat attack map

Web app for encryption, encoding, compression

Elsearch cluster browser

OSINT automation tool

---

CyberPot 24.04.2 • Multi-Platform Honeypot • GitHub • Documentation