I am deploying a vulnerable web application for students (about 100) in a university, that they can test online and am collecting all the traffic for research purposes.

I am deploying this machine on an ESX hosting other machines, and am concerned about the security issues involved.

Any recommendations/links/tips available will be great.

  • 2
    Try searching for a guide on setting up high interaction honeypots that fits your setup (e.g. ESX, desired OS). The security needs are comparable.
    – Legolas
    Mar 19, 2012 at 14:59

3 Answers 3


Draconian firewall rules. If you know how the application is vulnerable, then you can write rules to expect those responses from the application and nothing else and to limit how far the known vulnerabilities go, while still gathering the traffic data. You could even write rules so that expected 'bad' responses from the server are redirected to a black hole or another server so that you can capture that traffic, too.

I would also make sure that the virtual machines and server do not have access to other VM/servers or networks.

As Legolas says, you are setting up a high interaction honeypot, so set it up like that to begin with, but you need to limit the actual malicious responses that your server creates.


I suggest you put them on a LAN and your students can surf to them through a VPN setup. It's a lot safer than putting them just on the internet. If you just put them on the internet, you get attention from non-students as well.

You answered your question yourself, a vulnerable application on the internet.

Ok so you need to bear in mind:

  • jail applications, do not let them be able to even see other folders.
  • Partition your hard drive so they can only fill a folder where they would have access with an exploit, otherwise they might crash the system
  • use least privileged principle
  • Watch out with applications being able to write stuff (I know for instance that with sql injection in mysql one can create a file that generates a php shell)
  • Monitor and log everything
  • Limit upload and download
  • Firewall the machine so they can not set up an email spambot
  • Limit memory and cpu time
  • Separate this network completely from your own network

  • Firewall: whitelist instead of blacklisting

  • 2
    The thing is that it is a possibility that students will do something malicious as well, so I want to secure other machines from students and non-students.
    – Evilwill
    Mar 19, 2012 at 14:54
  • ok I shall edit my answer Mar 19, 2012 at 19:06

This might be obvious, but I'd like to add two more suggestions:

  1. Put a secure authentication mechanism in front of your vulnerable web application. If you're running Apache, I'd recommend just locking down the whole application directory with a username and password via Apache. If you distribute those credentials only among your students, that will put up another barrier in the path of outside/unwanted attackers.
  2. Host your vulnerable web application from a virtual machine, if possible. That way, you've got another layer of separation between this application and your actual infrastructure (though by no means a bulletproof one), and you can also easily revert your webserver to its original image on a nightly or discretionary basis.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .