Intrusion Detection System & Honeypot | Security Tool by Husain Hakim

Project Overview & Threat Context

A multi-tier cybersecurity simulation designed to demonstrate web application vulnerabilities and defensive intrusion detection techniques. Features a deliberately vulnerable honeypot, a hardened main server, a real-time log-monitoring IDS, and automated attack testing scripts.

Problem Statement & Objective

Understanding modern application security requires viewing systems from both offensive and defensive perspectives. Traditional single-server labs fail to illustrate how defenders detect intrusion attempts in real-time or how honeypots divert attackers away from hardened production assets while logging attacker behavior.

Security Concepts & Principles

• Honeypot Architecture & Deception
• SQL Injection (Raw Concatenation vs Parameterization)
• Stored & Reflected Cross-Site Scripting (XSS)
• Real-Time Log Tailing & Ingestion
• Threshold-Based Brute Force Detection
• Attack Automation & Detection Evasion

Technologies & Tools

• Node.js
• Express.js
• sql.js (WebAssembly SQLite)
• JavaScript
• CLI

Technical Architecture & Mechanics

• Honeypot Tier (honeypot.js): Deliberately flawed web portal featuring raw SQL query concatenation for authentication bypass, weak default credentials ('admin'/'admin123'), and an unescaped guestbook vulnerable to Stored XSS, backed by an embedded sql.js WebAssembly SQLite engine.
• Hardened Main Server (main.js): Running on port 4000 implementing defensive best practices including parameterized SQL queries and password hashing, while embedding a subtle Reflected XSS flaw in /search for deeper investigative discovery.
• Real-Time IDS Engine (ids.js): File-tailing monitor tracking activity.log generated by shared middleware. Maintains sliding time windows per session ID and triggers high-severity alerts when 5+ login attempts occur within 10 seconds.
• Shared Tracker Middleware (tracker.js): Generates anonymous session tokens for all visitors and writes structured timestamped telemetry to activity.log.
• Attack Suite (attack.js): Automation utility featuring --fast mode (rapid brute-forcing that triggers IDS alerts) and --slow mode (stealth delay intervals designed to evade detection thresholds).

Key Capabilities & Features

• Multi-tier architecture contrasting vulnerable honeypot endpoints against hardened production servers.
• Embedded WebAssembly SQLite database (sql.js) providing authentic query parsing without external database dependencies.
• Real-time sliding-window IDS detecting rapid brute-force authentication attacks.
• Full attack simulation suite testing detection limits with aggressive vs. evasion-tuned attack modes.
• Detailed request tracking telemetry with anonymous session tracking across endpoints.

# Start the honeypot, hardened main server, and IDS monitor
$ node honeypot.js & node main.js & node ids.js

# Launch an aggressive brute-force attack (triggers real-time IDS alert)
$ node attack.js --fast

# Launch a stealth attack (evades 5 attempts / 10s sliding window)
$ node attack.js --slow

Lessons Learned

• Contrasted vulnerable SQL string interpolation with parameterized queries and examined how database engines process injected tokens.
• Engineered real-time log tailing and time-windowed state aggregation in Node.js for low-latency alert generation.
• Explored the dynamics of intrusion evasion, understanding why static rate-based thresholds must be paired with behavioral heuristics.
• Integrated sql.js (WebAssembly SQLite) to create a self-contained, zero-setup offensive/defensive lab environment.

Future Roadmap

• Add automated IP banning / iptables integration triggered by IDS alerts.
• Implement signature-based payload detection (e.g., regex patterns for SQLi payloads and script tags).
• Build a real-time web telemetry dashboard showing live session paths and intrusion events.