Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been writing a high interaction honeypot which has required some interesting design decisions, for instance I want the honeypot to get attacked not the underlying infrastructure/ software. Fun stuff.

However I've got an issue and was looking for best practice advice.

Basically the honeypot is an insecure web application which has the ability to change the password.

Now suppose Attacker A changes the password he could expect to come back as Attacker A and use the password he has just set. However if Attacker A clears his browser (I had been tracking via a session cookie) he'll become Attacker B but would still expect to get in on Attacker A's password. At the same time Attacker C might try and access but the password set by Attacker A might be really hard/ not default and I'd miss the opportunity to get Attacker C.

I can keep all the passwords and let them long in by any of these plus the defaults but risk Attacker A having set a new password typing in a default and it still working - acceptable risk?

or I accept that its unlikely to get two people at the same time and reset everything all the time, but accept Attacker A might come back and wonder by the password he set no longer works but the defaults do?

I've basically written code behind someone's web site so don't really want to modify any of the JavaScript or anything as this might make it look unlike the real deal.

share|improve this question
up vote 1 down vote accepted

Why not just accept all the passwords, you could, every time they set a new password, add it to a password list. All passwords in the list will be accepted rather than just one password. It might get spotted, but I believe the likelihood could be quite low OR it could be seen as a vulnerability.

You could then add some behavior to make it less obvious, for instance add logic which says that if you have seen the IP before, then the password must be the password that the person last set from that particular IP. This will not cover people using proxies which change their IP constantly, but it should give you some coverage.

share|improve this answer
Thanks, think I will take an approach similar to this – David Jun 27 '13 at 7:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.