HoneyDesk

Inspiration

Most students face fake Canvas logins, fraudulent scholarship forms, and Discord bots demanding verification. Scoring a pasted link tells you a little. It never shows you how the attack works.

I built the opposite. I built fake student portals on purpose, for defense.

What it does

HoneyDesk deploys decoy surfaces to trap scam behavior, classify attacks in real time, and generate a plain English brief any student can act on.

• Fake portal login
• Fake scholarship form
• Fake Discord verify bot
• Real-time classification
• Plain English victim brief
• STIX export for school IT

Note: there is a login feature that allows users to have separate sessions, so that it is more organized. Sign up with your email and create a password!

Demo path (approx 90 seconds): sign up → open the ops dashboard → submit the portal decoy → watch the event row detonate and the pipeline animate → read the victim brief → replay seeded scenarios → export JSON for school IT.

Ethics: authorized deception and training only. HoneyDesk never stores plaintext passwords. The demo uses seeded replay, so it never depends on unsolicited attackers.

The main aim here is to educate students about how dangerous phishing scams are, and what exactly they can steal. Using mock fake websites that "steal" information from the user and processing each scenario through an AI pipeline that returns feedback, students can become more educated and aware when receiving these types of links.

How I built it

Frontend: Next.js App Router with TypeScript, Tailwind, and shadcn/ui. Covers the landing page, auth, live dashboard, and decoy pages that call POST /capture.

Backend: FastAPI with SQLite. Handles auth through opaque bearer sessions, capture with secret redaction, rules-first classification, enrichment through geo and user-agent data, and LLM-generated victim briefs, with cached fallbacks for scenarios SC-1 through SC-3.

Pipeline:

$$\text{Capture} \rightarrow \text{Classify} \rightarrow \text{Enrich} \rightarrow \text{Brief}$$

Rules classify first. The model explains second. Replay and simulation runs the same pipeline as live captures.

Safety: Redaction happens at the capture boundary. Rate limits and per-user event isolation apply throughout, with an optional simulate token for testing.

I kept a living docs/ folder with PRD, architecture, features, and error references, so AI-assisted sessions stayed consistent under hackathon time pressure.

Challenges I ran into

• Async briefs vs. demo theater: POST /capture returns immediately while the pipeline runs in the background. This meant the dashboard could show an event before the brief was ready. I fixed it with polling until brief_victim lands, without blocking the trap spring on an LLM call.
• Demo reliability: live LLM calls fail when the network fails. Cached briefs for seeded scenarios, plus failover copy, keep the judge path working with or without an API key.
• Scope vs. spectacle: I cut SSE and deeper IT-brief work once the poll-based dashboard told the story on its own. Rules classify, AI explains, the theater stays honest.

Accomplishments that I'm proud of

• A trap-to-brief-to-export loop that lands in under 90 seconds
• Real per-user auth isolation, so each tester's captures stay private
• A redaction layer that never persists plaintext passwords
• A 40+ test suite covering auth, capture, classify, pipeline, simulate, STIX, and the database
• Seeded SC-1, SC-2, and SC-3 replays, so the demo never depends on random internet attackers

What I learned

• Theater with integrity beats a quieter "paste a link" tool for education. Students remember what they did, not a risk score.
• Failing closed on secrets, and running rules before the LLM, keeps AI features demo-safe.
• Structured markdown context for features, errors, and architecture beats relying on chat history to remember decisions.
• Shipping the happy path first (portal → dashboard → brief → replay → export) beats half-finished polish on lower-priority features.

What's next for HoneyDesk

• Full IT brief generation with PDF one-pagers for school admins
• Attack map and geo visualization, with MITRE ATT&CK mapping chips
• Optional SSE live feed and AbuseIPDB-style enrichment
• A real Discord bot decoy
• A hardened deploy story and a classroom-ready "authorized training only" kit for clubs and school IT

Built With

• fastapi
• next.js
• node.js
• python
• react
• render
• rest-api
• shadcn/ui
• sqlite
• stix
• tailwind-css
• typescript
• uvicorn