Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does this, but in order to keep the hacker's attention in a fixed point for some time, I would like to have some fake data.

Does anyone have a suggestion on a starting point? All the data would be statically served, I was thinking maybe some linux directory structure, but preferably something more light weight. If there is something like this you are aware of, I would be interested. It does not need to be complete, just contain a bunch of files that would typically be found on a (web)server.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You could create a url rewrite rule mapping urls matching ../etc/* (or some other expression) to somevirtualdirectory/* and place whatever you like in somevirtualdirectory to be served.

Damn Small Linux would have your basic minimal *nix folder hierarchy on live CD that you could copy over and lock down (remove execute permissions and such).

share|improve this answer
    
Sorry if I was not clear, but that is not what I am asking. I am asking if you have a suggestion on a fake hierarchy I can copy to somevirtualdirectory so I don't have to start from scratch. –  George Bailey Dec 29 '11 at 22:36
    
Damn Small Linux would have your basic minimal *nix folder hierarchy on live CD that you could copy over and lock down (remove execute permissions and such). –  pdubs Dec 29 '11 at 23:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.