# Tutorial: Your first honeypot lab (beginners / students)

**Audience:** Students, newcomers to cybersecurity, or anyone who wants a safe
local lab without cloud accounts or production hardening.

**Time:** about 15-20 minutes  
**Outcome:** You run a loopback honeypot, connect like an “attacker,” and stop
the lab cleanly.

!!! warning "Research only"
    This path is for **local learning**. Do not expose the honeypot to the
    Internet. See [safety model](../explanation/safety-model.md).

## What you will learn

1. What a honeypot is in CyberHalluciNet (a **fake** service that records probes)
2. How to start Ops and launch a small SSH/HTTP lab
3. How to connect from your own machine and see that it responds
4. How to stop everything safely

## Prerequisites

- A laptop with **Docker Desktop** or **Docker Engine** running
- This repository checked out
- Optional: Go 1.22+ only if you build from source (`make doctor`)

You do **not** need: cloud accounts, GPUs, Firecracker/KVM, or API keys.
AI is **off by default**.

## Step 1: Build Ops and check Docker

From the repository root:

```bash
make ops-web build
./bin/ops-gui -doctor
```

If doctor says Docker is NOT READY, start Docker Desktop (or the Docker daemon)
and run doctor again.

## Step 2: Start the Ops UI

```bash
export CYBERHALLUCINET_REPO_ROOT="$PWD"
./bin/ops-gui -addr 127.0.0.1:3080
```

Open [http://127.0.0.1:3080/](http://127.0.0.1:3080/) in your browser.

Ops listens on **loopback only** (`127.0.0.1`). That means only your computer
can reach it.

## Step 3: Launch a tiny lab

1. Open the **Launch** tab.
2. Keep a simple preset (SSH and/or HTTP is enough).
3. Click **Start** and wait until **Manage** shows the lab healthy.

Connection hints in Manage should point at addresses like:

- SSH: `127.0.0.1:2222`
- HTTP: `127.0.0.1:8081`

(Exact ports depend on your selection.)

## Step 4: Play the attacker (safely)

### HTTP

```bash
curl -sS http://127.0.0.1:8081/healthz
```

You should get a JSON-ish or HTML-ish decoy response, that is the **fake**
application, not Ops.

### SSH (optional)

```bash
ssh -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null student@127.0.0.1
```

Use any password the lab accepts for the synthetic persona (research decoys use
fake credentials). Explore a few commands (`whoami`, `ls`, `uname -a`). You are
inside a **simulated** environment, not a real server shell.

## Step 5: Look at Manage

In the Ops **Manage** tab, note:

- Which services are running
- Loopback ports
- That you can **Stop** the lab when finished

## Step 6: Stop the lab

Use **Stop** in Manage, or from a terminal:

```bash
./bin/honeypotctl emergency local-stop
# or tear down research compose if you used that path:
# make research-down
```

Confirm containers are gone (`docker ps` should not list your lab sensor).

## Compose-only alternative (no UI)

If you prefer the CLI:

```bash
make research-up
make research-self-test
# try: curl -sS http://127.0.0.1:8081/healthz
make research-down
```

## Checkpoint: did it work?

- [ ] Ops opened on `http://127.0.0.1:3080/`
- [ ] Lab showed healthy in Manage (or `research-self-test` passed)
- [ ] You got a response from the decoy HTTP (or SSH) on loopback
- [ ] You stopped the lab cleanly

## What to read next

- [Quick start (short form)](../getting-started/quickstart.md)
- [Launch and manage a lab](../how-to/launch-manage-lab.md)
- [Research vs hardening](../explanation/research-vs-hardening.md): why this
  path stays simple on purpose
- When you are ready for SOC/IR workflows:  
  [Tutorial: Blue-team operator path](blue-team-advanced.md)

## Classroom tips

- Work in pairs: one runs Ops, one “attacks” with `curl`/`ssh`
- Never point scanners at school networks or the public Internet from this lab
- Treat everything you see as **synthetic**, no real credentials, no real data