# Tutorial: Database decoys for beginners

**Audience:** Students and newcomers who already completed the
[first honeypot lab](beginner-student-lab.md) (or equivalent) and want to see
**fake databases** that look real on the wire.

**Time:** about 25-35 minutes  
**Outcome:** You run Redis, MySQL, and PostgreSQL decoys on loopback, authenticate
with industry clients, run a few recon commands, and understand that **no real
database engine** is running on your laptop.

!!! warning "Research only: loopback"
    Keep every `--listen-*` on `127.0.0.1`. Do not publish these ports to the
    Internet for this tutorial. See [safety model](../explanation/safety-model.md).

## What you will learn

1. Why CyberHalluciNet speaks real DB wire protocols (RESP, MySQL CS, Postgres FE/BE)
2. How to start Contained-tier DB Listen decoys with the sensor binary
3. How to connect with `redis-cli`, `mysql`, and `psql`
4. How abuse-shaped commands get **native errors** (not TCP drops)
5. Where to read transcripts / stop the lab

## Prerequisites

- Repository checked out; Docker optional (not required here)
- Go toolchain able to build the sensor (`make doctor` or `cd engine && go build ./cmd/sensor`)
- Client tools (install what you need):
  - `redis-cli` (Redis)
  - `mysql` client **or** skip the MySQL step
  - `psql` **or** skip the Postgres step

You do **not** need: Ollama, Live ack, MicroVM, or cloud accounts. AI stays off.

## Background (2 minutes)

A honeypot database is not `mysqld` or `redis-server` on the sensor. It is a
**protocol emulator** that:

- sends the right handshake / banners for a chosen persona version,
- accepts synthetic credentials,
- answers a useful recon subset (`PING`, `INFO`, `SELECT @@version`, …),
- refuses dangerous ops with **plausible native errors**.

That keeps scanners and human attackers engaged while containment rules hold.

| Port | Decoy | Real engine on sensor? |
|------|-------|------------------------|
| 6379 | Redis RESP | No |
| 3306 | MySQL | No |
| 5432 | PostgreSQL | No |

## Step 1: Build the sensor

From the repository root:

```bash
cd engine
go build -o ../bin/sensor ./cmd/sensor
mkdir -p /tmp/chn-intel-db
```

## Step 2: Start three Contained DB decoys

In a dedicated terminal:

```bash
./bin/sensor \
  --profile=research \
  --interaction=contained \
  --listen-status=127.0.0.1:8080 \
  --listen-redis=127.0.0.1:6379 \
  --listen-mysql=127.0.0.1:3306 \
  --listen-postgres=127.0.0.1:5432 \
  --intel-dir=/tmp/chn-intel-db \
  --sensor-id=student-db-01
```

Leave it running. Status stays on loopback `:8080`.

!!! tip "Credentials"
    With no custom persona files, the sensor uses embedded research samples.
    Passwords below match `SampleRedis` / `SampleMySQL` / `SamplePostgres` in
    `engine/internal/persona/persona.go`. They are **fake** lab secrets.

## Step 3: Redis (easiest win)

```bash
redis-cli -h 127.0.0.1 -p 6379 -a 'R7q!kLp2vMx9' PING
# expect: PONG

redis-cli -h 127.0.0.1 -p 6379 -a 'R7q!kLp2vMx9' INFO server | head
redis-cli -h 127.0.0.1 -p 6379 -a 'R7q!kLp2vMx9' KEYS '*'
```

Try a classic abuse probe, you should get a Redis-shaped error, **not** a hang
or silent disconnect:

```bash
redis-cli -h 127.0.0.1 -p 6379 -a 'R7q!kLp2vMx9' SLAVEOF 127.0.0.1 6379
# expect: -ERR … (native refuse)
```

## Step 4: MySQL

```bash
mysql -h 127.0.0.1 -P 3306 -u appuser -p'Jh5&tQx8nWc3' --protocol=TCP -e "SELECT @@version"
mysql -h 127.0.0.1 -P 3306 -u appuser -p'Jh5&tQx8nWc3' --protocol=TCP -e "SHOW DATABASES"
```

Wrong password should return an ERR packet (access denied), not a TCP reset.

## Step 5: PostgreSQL

```bash
PGPASSWORD='Fk2@dRs5yTm7' psql -h 127.0.0.1 -p 5432 -U appuser -d app -c 'SELECT version()'
```

Optional: `SHOW search_path;` or a simple `SELECT 1;`: the decoy answers a
bounded subset; unsupported SQL returns a native ErrorResponse.

## Step 6: Peek at intel (optional)

If session intel is writing under `--intel-dir`:

```bash
find /tmp/chn-intel-db -type f | head
```

You may see protocol transcripts for Redis/MySQL/Postgres sessions. Content is
for analysts: treat paths as sensitive lab data.

## Step 7: Stop cleanly

In the sensor terminal: `Ctrl-C`. Confirm ports are free:

```bash
# should fail to connect
redis-cli -h 127.0.0.1 -p 6379 PING || true
```

## What you proved

- Industry clients completed handshake + auth against **emulators**
- Recon worked; abuse got native refusals
- No `redis-server` / `mysqld` / `postgres` process needed on the host

## Next tutorials

| Level | Tutorial |
|-------|----------|
| Medium / AI | [Database decoys with AI bait](db-decoys-ai-emulated.md) |
| High interaction | [Live Redis dual-session](db-decoys-live-redis.md) |

Also useful: [How-to: database decoys](../how-to/database-decoys.md) ·
[Reference](../reference/database-decoys.md) ·
[Beginner SSH/HTTP lab](beginner-student-lab.md)