Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?

Question

I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does this, but in order to keep the hacker's attention in a fixed point for some time, I would like to have some fake data.

Does anyone have a suggestion on a starting point? All the data would be statically served, I was thinking maybe some linux directory structure, but preferably something more light weight. If there is something like this you are aware of, I would be interested. It does not need to be complete, just contain a bunch of files that would typically be found on a (web)server.

Answer 1

You could create a url rewrite rule mapping urls matching ../etc/* (or some other expression) to somevirtualdirectory/* and place whatever you like in somevirtualdirectory to be served.

Damn Small Linux would have your basic minimal *nix folder hierarchy on live CD that you could copy over and lock down (remove execute permissions and such).