Questions tagged [honeypot]

a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

Filter by
Sorted by
Tagged with
0 votes
0 answers
38 views

Malware sinkhole evasion techniques

I have read into malware sink holing, as a way to disrupt botnets. There are also approaches to make this more difficult, for example using a Domain Name Generator algorithm which is what the ...
user avatar
0 votes
1 answer
57 views

How would you counter an email/honeypot mischief scenario?

I'm thinking through a mischief denial-of-service scenario that seems too easy to employ. Your web-site validates email addresses for new users on sign-up. A rogue party (a competitor) performs sign-...
user avatar
  • 103
27 votes
6 answers
7k views

How can I get more spam for my honeypot?

Spam is everywhere and everyone gets it (especially professors), but I noticed that my personal email does not get much spam. How can I get more? What are the most common ways of getting spam? Not ...
user avatar
  • 1,145
1 vote
2 answers
176 views

How is DNS sinkhole being use?

I had some difficulty in grasping the concept on how "DNS sinkhole" is being utilize. Is it like setting up something similar to a honeypot to lure attackers away from the actual network, so ...
user avatar
0 votes
0 answers
140 views

How to Minimize Risk of Remote Access from Potential Job Scam?

Question resolved: no reason at this time to assume the remote access was with any malicious intent. [skip this beginning if you want] My partner was offered a job with a real estate listing company ...
user avatar
0 votes
0 answers
70 views

Detect KPsensor HoneyPot

Is there any pattern or characteristics to identify a kpsensor? It is one of the most used. I have noticed that of the number of supposedly open ports, only those with a real service running respond ...
user avatar
0 votes
1 answer
214 views

Is it possible to create a honeytoken as an image file?

I though it would be an interesting idea for my final year project. A honeypot token in an image form, with a hidden script that will send you information about the user when the file is executed (...
user avatar
  • 1
1 vote
1 answer
244 views

How technically setup an honeypot

When I started reading about honeypots, I could understand what is honeypot, how it works theoretically, i.e it is a trap-network that may or may not mimics a real network, but because of my limited ...
user avatar
1 vote
1 answer
158 views

Do blue teams plant CTF like canaries across infrastructure?

I am working on a SaaS application that handles sensitive data. I had the idea of planting various canaries across our application / infrastructure to get early warnings of people being a bit too much ...
user avatar
  • 111
-5 votes
1 answer
435 views

Honeypot for hunting browser zero-days, rootkits and malware [closed]

I would like to create a honeypot (bot) to hunt browser zero-days (and browser extensions). What is the best way to find those 0days automatically (I would like to create a sandboxed bot which would ...
user avatar
1 vote
1 answer
301 views

Honeypot for Linux user

Let's consider the following scenario: You have a web -facing server, which runs software e.g. apache2 on separate Linux user www-data. An attacker finds a vulnerability and gets a remote shell on ...
user avatar
  • 3,733
1 vote
1 answer
560 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
user avatar
  • 11
-2 votes
2 answers
518 views

Honeypot detection: How is TCP/IP implemented on honeypots?

I'm currently studying how to do honeypot detection and was wondering if a possible lead is to analyse how honeypots implement their TCP/IP protocol. I've been looking through the source code for a ...
user avatar
  • 1
2 votes
1 answer
210 views

Concerning The OWASP Security Guidelines As They Apply To Site Registration / Could honeypotting work?

I'm tossing an idea around in my mind. I want to bounce it off the community to see if this holds any water. First - the OWASP guidelines never specify any method of action when you're dealing with ...
user avatar
2 votes
1 answer
232 views

Honeypot SSH connection attempts with no interaction

I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect. I'm thinking this is ...
user avatar
2 votes
0 answers
157 views

How to get malware campaign runners to use my mail honeypot?

I have a working mail honeypot but have yet to receive any malware. I've already tried submitting my domain to several unsubscribe forms, but it does not seem to have worked. Any suggestions would be ...
user avatar
0 votes
1 answer
319 views

Cowrie as a decoy on production server: is it a good idea?

I'm considering setting up a SSH honeypot listening on port 22 on my production servers. I'm hoping that not getting an immediate Connection refused would slow down potential attackers. Are there any ...
user avatar
  • 163
0 votes
0 answers
655 views

What are all of these IPs addresses? Honeypots?

I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
user avatar
1 vote
1 answer
199 views

Is there any interest in purchasing honeypot traffic data?

A friend of mine asked me this recently, and besides the obvious "try with antivirus vendors" I didn't know what to answer. He's been building a pretty large collection of data from a honeynet ...
user avatar
  • 11
1 vote
1 answer
222 views

scada honeypot guide help

With the recent vpn filter attacks, and talks about the hackers wanting to attack our SCADA systems in the U.S. I want to setup a honeypot to monitor the attackers and learn more about how they ...
user avatar
  • 41
-2 votes
2 answers
183 views

Any honeypot available to run webservice

I'm new to honeypots. I wanted to know if there are any honeypot platform for hosting my own webservice? I came across glasstopf but I read that it emulates its own web app.
user avatar
4 votes
2 answers
2k views

How to safely create a "honeypot (linux) user"

Would following be a feasible security feature to detect attempts? Creating a user with following specs: Username admin Password fairly insecure (not 123456, but a dictonary word) Special permissions:...
user avatar
  • 819
1 vote
0 answers
62 views

Honeypot confused where to deploy [duplicate]

Planning to deploy honeypot dionaea. Where should I deploy it? Google cloud (free trial) Raspberry pi (internal network) My home network is: router------ddwrt------raspberry pi (honeypot) And on ...
user avatar
1 vote
0 answers
544 views

redirect connection to honeypot service [closed]

i am currently redirecting attackers to themselves based on a few rules <iptables> -t nat -A PREROUTING -s <ip> -j DNAT --to-destination <ip> i was thinking that maybe it could be ...
user avatar
  • 111
1 vote
1 answer
430 views

Additional risks to home network in exposing (raspberry pi) honeypot to the internet

While I would like to contribute piping of logs from a home-deployed honeypot to the DSHIELD project using a raspberry pi, I am concerned that the additional exposure of the port to the internet would ...
user avatar
  • 739
0 votes
2 answers
281 views

Do the 'bad guys' create honeypots?

I know companies, governments, and other organizations create honeypots (ex: SQLi pages, Open Access Points, Open Ports, etc.) to lure in the bad guys. Are there any examples of the bad guys creating ...
user avatar
  • 35
4 votes
1 answer
4k views

The Shadow Server Foundation constantly trying to get access to mDNSResponder

Update September 2018: The events described below still happen to this day though less often from servers of The Shadow Server Foundation. By now I have denied access to most of their IP addresses, ...
user avatar
1 vote
0 answers
173 views

Splunk integration with HoneyD [closed]

In a previous thread someone mentioned about HoneyD causing logs to fill up too fast, there was a comment posted about using splunk. I am very interested in how to integrate HoneyD with Splunk, it ...
user avatar
  • 11
1 vote
2 answers
353 views

Can a honeypot really deflect damage back to the attacker?

The honeypot wikipedia article states: ...a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. ...
user avatar
1 vote
1 answer
1k views

Honeypot tricking my android device to connect

I have been facing this issue since a month where a neighbour access point is acting like a honeypot, all the nearby android devices are getting connected to it even after forgetting the network. The ...
user avatar
  • 123
0 votes
1 answer
306 views

False, honeypot like wifi

I have set cameras for security at home, because someone broke into my house. As the suspect doesnt want to give up (got a mail from him, lol), I want to find more info about him. Because cameras are ...
user avatar
  • 272
1 vote
2 answers
214 views

How to store malware executables?

I have been developing a simple honeypot system. Configuration of the honeypot system is: Main router R has two parts: part A and B. Part A is turned off and part B is set as a DMZ with a single PC ...
user avatar
1 vote
0 answers
179 views

Signature Generate by Honeyd “Honeycomb” is not accept by Snort IPS

I posted this on SO [https://stackoverflow.com/questions/44652014/signature-generate-by-honeyd-honeycomb-is-not-accept-by-snort-ips] is this on topic here? What would I need to do to my question ? I ...
user avatar
1 vote
1 answer
166 views

Break anonymity in a Kippo honeypot

I've installed a Kippo honeypot on my server and I wanted to know if there are some tools I can launch to collect more information about the cracker. I want more information to be able to start some ...
user avatar
  • 11
3 votes
1 answer
178 views

What OS should I use for sandboxing/running viruses designed for IoT devices?

I have a telnet and ssh honeypot (more specifically, cowrie). Most viruses I get there are designed for routers, cameras, etc... The virtualization software I am using is VirtualBox, and I am using ...
user avatar
  • 199
2 votes
0 answers
529 views

Potential Issues and downfalls of the "honeyPot" in asp.net mvc

Within the last few weeks I have been noticing massive amounts of bot traffic coming out of a small geographical area. I have implemented the robots.txt into my ASP.net project, but as I understand it,...
user avatar
  • 157
4 votes
2 answers
900 views

How relevant is the honeypot technique today?

I have been reading about honeypots and different implementation of them, while some articles are recent most of them are old (more than ten years ago) I was wondering if honeypots are still relevant ...
user avatar
0 votes
1 answer
582 views

Full isolation of a honeypot on a single Internet line?

What happens when you swap a modem and router out with a different modem and router? Can you achieve full isolation by alternating between which network is plugged into the Internet line? I am ...
user avatar
  • 157
4 votes
1 answer
1k views

Why aren't telnet bots finishing the three-way handshake?

I have a port forwarding rule sending 23 traffic to a "honeypot" (called "comp" below). Throughout the night, many bots from around the world attempted to connect, but there was no service running. ...
user avatar
  • 305
-3 votes
1 answer
1k views

Explanation of Honeypot diagram

Can someone please give me an exact explanation of what is happening in the diagram below? I have tried to find a diagram explaining the honeypot process but I can't seem to find a clear explanation. ...
user avatar
  • 1
33 votes
8 answers
9k views

Giving malicious crawlers and scripts a hard time

My webserver has been up for < 25 hours and has already been crawled for various default pages, just to name one /administrator/index.php. I understand that this is very common and it's not really ...
user avatar
  • 979
9 votes
1 answer
668 views

Fingerprint ssh attack tool

I noticed a high volume of SSH password attempts on my server and installed the Cowrie honeypot to see what the attacker(s) would do if they actually got access. I've identified consistent patterns ...
user avatar
  • 301
-5 votes
1 answer
387 views

how can one find the honeypot [closed]

how can one find the honeypot while want to observe the other hackers.
user avatar
2 votes
1 answer
1k views

Is it a good approach to deploy a honeypot behind the firewall

I am using a linux box as a firewall and router. I would install a system running honeypots like kippo, dionaea or glastopf behind it. My honeypot is on private IP and all required ports are being ...
user avatar
0 votes
1 answer
483 views

Decoding Honeypot Payload

Apologies for the basic question. I have searched, but I had trouble even determining search terms. I set up a Cowrie honeypot (SSH/Telnet) last night on a VPS. I find this in the cowrie log today. ...
user avatar
  • 103
3 votes
2 answers
5k views

Would I create a WiFi honeypot by setting up a fake network with a generic name like "linksys"?

On this page Apple says the following: SSID (Service Set Identifier—Wi-Fi network name) The SSID, or network name, identifies your Wi-Fi network to users and other Wi-Fi devices. It is case ...
user avatar
  • 251
3 votes
2 answers
872 views

How far is honeypot legal? [closed]

I have reasons to think that my private message are watched by the site's support that I'm on. This is legal due to the TOS I had to valid when I subscribed to this website. Howewer, I would like to ...
user avatar
  • 2,874
0 votes
2 answers
1k views

Configure http honeypot on my ubuntu server [closed]

I want to configure an http honeypot on my ubuntu server. I am using apache web server. I am thinking to set 80 port for the honeypot and some other unusual port like 8978 or 6723 for my site. I will ...
user avatar
  • 79
17 votes
2 answers
13k views

How to force clients to connect to WiFi automatically?

I have watched a hak5 YouTube that they did make people connect to their wifipineapple (a WiFi Honey pot) , and they stored the Wi-Fi hotspots, those the phone used to connect to. The historical ...
user avatar
  • 387
4 votes
0 answers
509 views

Preventing Dionaea Service Identification

I've been working on trying to prevent Dionaea service identification using articles such as this. I've managed to disguise most of the ports that dionaea utilizes. However, when scanning with nmap, ...
user avatar