a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

learn more… | top users | synonyms

8
votes
1answer
126 views

How to understand QEBEK (Honeypot Monitoring Tool)?

I've been trying for some time to find recent or meaningful documentation regarding QEBEK, but all I've found is the Intro and KYT Paper for Installation 2010. The links are just a formal introduction,...
-1
votes
1answer
282 views

How to detect a Dionaea Honeypot, is it possible or not?

There is a question like this but the answers aren't sufficient to me. I am interested in a honeypot project and I use the dionaea honeypot. This project is really cool, but there is a problem. How ...
6
votes
0answers
84 views

Is there a place where I can upload my honeypot logs to?

Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of ...
3
votes
0answers
41 views

Preventing Dionaea Service Identification

I've been working on trying to prevent Dionaea service identification using articles such as this. I've managed to disguise most of the ports that dionaea utilizes. However, when scanning with nmap, ...
1
vote
0answers
25 views

Honeypot Configuration - Alerting with Mandrill

Has anyone connected the OpenCanary Honeypot Correlator to Mandrill? There is a section of the opencanary_correlator.conf file that allows for the Mandrill API key but for no other configuration. How ...
1
vote
0answers
38 views

PGP 'forced entry' decode (steganography?)

This was originally posted by me on stackoverflow but was deemed too generic. It does seem like an impossible thing to do, but: you know when you have your perimeter alarm system you usually get ...
1
vote
0answers
59 views

problem blocking TCP scans by setting up honeyd in virtual environment

I am creating a virtual environment where I have created three virtual machines, CentOS as an Apache Webserver CentOs as an Attacker machine FreeBSD with Honeyd to setup Honeypot I have ...
1
vote
0answers
135 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
1
vote
0answers
108 views

Suppressing broadcast traffic in honeyd logs?

I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters? User subnet 192.168.20.0/24, ...
0
votes
0answers
57 views

I can't get the honeyd to run in loopback interface

I've been working on honeyd for two day and am struggling with it. What I'd like to do is that I'd want to run it on my own localhost (i.e. loopback interface). But I'm keep getting the following ...
0
votes
0answers
95 views

Script to emulate DNS for Windows machine in honeyd

I want to simulate virtual Windows hosts using honeyd. To do so I have installed honeyd. I have configured honeyd as Windows XP SP1, and now I want to emulate DNS services on it. I used UDPot as a DNS ...