Overview My Role Tools Red Team Tactics Findings Lessons Screenshots Links
Cyber Dollz • Charlie’s Angels Mode

Operation Honeypot‑Canary: Cyber Dollz Initiative

Phase 2 Capstone — a controlled Red vs Blue engagement targeting an AWS S3 static website instrumented with honeypots and canary tokens.
My role: Red Team Member & Technical Writer.

Mission Overview

We deployed a high‑end art site on AWS S3 (static website hosting) and embedded deception controls to detect adversarial behavior. The Red Team simulated realistic reconnaissance and probing while the Blue Team validated alerting and containment inside a low‑cost sandbox.

  • Target: Public S3 website endpoint
  • Deception: Honeypot pages + embedded canary tokens
  • Methodology: Red vs Blue with Purple Team collaboration

Highlights

  • Day 1 activity produced a burst of alerts — deception working as designed.
  • Live demo day surfaced intermittent signals — led to reliability tuning.
  • IAM least privilege reduced blast radius and protected sensitive assets.
Scope note: Phase 2 did not include Wazuh; SIEM work occurs in later phases.

Role — Red Team Member

  • Planned & executed reconnaissance and web probing of the S3‑hosted site.
  • Interacted with decoys deliberately to validate canary coverage.
  • Captured artifacts, timelines, and reproducible commands.

Key Contributions

  • Repeatable playbook for nmap, dig, nikto, gobuster, whatweb, aws CLI.
  • DevTools workflow to locate canary URLs/variables in client‑side JS.
  • Risk notes & defensive recommendations for Purple Team.

Role — Technical Writer

  • Authored overview, runbooks, and red‑team procedure guide.
  • Standardized evidence capture (screens, hashes, logs).
  • Drafted Lessons Learned and cross‑linked to Purple Playbook.

Tools & Technologies

AWS S3 (Static Website) IAM (Least Privilege) Canary Tokens Nmap Dig Nikto Gobuster WhatWeb AWS CLI Browser DevTools

Red Team Tactics

Recon & Mapping

  • nmap -Pn -sV -T4 <target-host>
  • dig +short CNAME <domain>
  • whatweb <target-url>

Web Scanning

  • nikto -h <target-url>
  • gobuster dir -u <target-url> -w <wordlist> -e

S3 Intel

  • Review bucket naming patterns; check public listings if permitted.

Deception Interaction

  • DevTools → Sources → locate canary references & data attributes.
  • Trigger tokens, capture timestamps and request metadata.

Evidence Collection Standard

  • Record exact commands & full console outputs.
  • Screenshot findings; save with ISO‑8601 timestamps.
  • Hash artifacts (sha256sum) & store in evidence folder.
  • Maintain a shared timeline for Purple debrief.

If a tool errors (e.g., nikto config), rerun with minimal flags and log stderr verbatim.

Key Findings

  • Deception controls detected scripted probing during early tests.
  • Intermittent alerting during the live demo → reliability tuning needed.
  • IAM scoping reduced accidental exposure risk.

Purple Team Notes

  • Shared attacker timelines + token trigger points.
  • Recommended canary placement in high‑value paths & JS variables.
  • Documented remediation for Blue Team follow‑up.

Lessons Learned

  • Coverage + consistency matter as much as clever decoys.
  • Repeatability via runbooks turns hunches into evidence.
  • Least privilege limits blast radius even during demos.

For detailed remediation, see our internal Purple Playbook.