Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [honeypot]

a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

2
votes
1answer
67 views

Concerning The OWASP Security Guidelines As They Apply To Site Registration / Could honeypotting work?

I'm tossing an idea around in my mind. I want to bounce it off the community to see if this holds any water. First - the OWASP guidelines never specify any method of action when you're dealing with ...
2
votes
1answer
95 views

Honeypot SSH connection attempts with no interaction

I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect. I'm thinking this is ...
1
vote
0answers
67 views

How to get malware campaign runners to use my mail honeypot?

I have a working mail honeypot but have yet to receive any malware. I've already tried submitting my domain to several unsubscribe forms, but it does not seem to have worked. Any suggestions would be ...
0
votes
1answer
110 views

Cowrie as a decoy on production server: is it a good idea?

I'm considering setting up a SSH honeypot listening on port 22 on my production servers. I'm hoping that not getting an immediate Connection refused would slow down potential attackers. Are there any ...
0
votes
0answers
191 views

What are all of these IPs addresses? Honeypots?

I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
1
vote
1answer
107 views

Is there any interest in purchasing honeypot traffic data?

A friend of mine asked me this recently, and besides the obvious "try with antivirus vendors" I didn't know what to answer. He's been building a pretty large collection of data from a honeynet ...
1
vote
1answer
111 views

scada honeypot guide help

With the recent vpn filter attacks, and talks about the hackers wanting to attack our SCADA systems in the U.S. I want to setup a honeypot to monitor the attackers and learn more about how they ...
-2
votes
2answers
91 views

Any honeypot available to run webservice

I'm new to honeypots. I wanted to know if there are any honeypot platform for hosting my own webservice? I came across glasstopf but I read that it emulates its own web app.
4
votes
2answers
926 views

How to safely create a “honeypot (linux) user”

Would following be a feasible security feature to detect attempts? Creating a user with following specs: Username admin Password fairly insecure (not 123456, but a dictonary word) Special ...
1
vote
0answers
51 views

Honeypot confused where to deploy [duplicate]

Planning to deploy honeypot dionaea. Where should I deploy it? Google cloud (free trial) Raspberry pi (internal network) My home network is: router------ddwrt------raspberry pi (honeypot) And on ...
1
vote
0answers
207 views

redirect connection to honeypot service [closed]

i am currently redirecting attackers to themselves based on a few rules <iptables> -t nat -A PREROUTING -s <ip> -j DNAT --to-destination <ip> i was thinking that maybe it could be ...
1
vote
1answer
216 views

Additional risks to home network in exposing (raspberry pi) honeypot to the internet

While I would like to contribute piping of logs from a home-deployed honeypot to the DSHIELD project using a raspberry pi, I am concerned that the additional exposure of the port to the internet would ...
0
votes
2answers
208 views

Do the 'bad guys' create honeypots?

I know companies, governments, and other organizations create honeypots (ex: SQLi pages, Open Access Points, Open Ports, etc.) to lure in the bad guys. Are there any examples of the bad guys creating ...
4
votes
1answer
2k views

The Shadow Server Foundation constantly trying to get access to mDNSResponder

Update September 2018: The events described below still happen to this day though less often from servers of The Shadow Server Foundation. By now I have denied access to most of their IP addresses, ...
1
vote
0answers
108 views

Splunk integration with HoneyD [closed]

In a previous thread someone mentioned about HoneyD causing logs to fill up too fast, there was a comment posted about using splunk. I am very interested in how to integrate HoneyD with Splunk, it ...
1
vote
2answers
197 views

Can a honeypot really deflect damage back to the attacker?

The honeypot wikipedia article states: ...a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. ...
1
vote
1answer
620 views

Honeypot tricking my android device to connect

I have been facing this issue since a month where a neighbour access point is acting like a honeypot, all the nearby android devices are getting connected to it even after forgetting the network. The ...
0
votes
1answer
206 views

False, honeypot like wifi

I have set cameras for security at home, because someone broke into my house. As the suspect doesnt want to give up (got a mail from him, lol), I want to find more info about him. Because cameras are ...
1
vote
2answers
104 views

How to Store malware executables?

I have been developing a simple honeypot system. Configuration of the honeypot system is : 1. Main router R has two parts: part A and B. 2. Part A is turned off and part B is set as a DMZ with a ...
1
vote
0answers
90 views

Signature Generate by Honeyd “Honeycomb” is not accept by Snort IPS

I posted this on SO [https://stackoverflow.com/questions/44652014/signature-generate-by-honeyd-honeycomb-is-not-accept-by-snort-ips] is this on topic here? What would I need to do to my question ? I ...
1
vote
1answer
122 views

Break anonymity in a Kippo honeypot

I've installed a Kippo honeypot on my server and I wanted to know if there are some tools I can launch to collect more information about the cracker. I want more information to be able to start some ...
3
votes
1answer
128 views

What OS should I use for sandboxing/running viruses designed for IoT devices?

I have a telnet and ssh honeypot (more specifically, cowrie). Most viruses I get there are designed for routers, cameras, etc... The virtualization software I am using is VirtualBox, and I am using ...
2
votes
0answers
214 views

Potential Issues and downfalls of the “honeyPot” in asp.net mvc

Within the last few weeks I have been noticing massive amounts of bot traffic coming out of a small geographical area. I have implemented the robots.txt into my ASP.net project, but as I understand it,...
4
votes
2answers
379 views

How relevant is the honeypot technique today?

I have been reading about honeypots and different implementation of them, while some articles are recent most of them are old (more than ten years ago) I was wondering if honeypots are still relevant ...
0
votes
1answer
262 views

Full isolation of a honeypot on a single Internet line?

What happens when you swap a modem and router out with a different modem and router? Can you achieve full isolation by alternating between which network is plugged into the Internet line? I am ...
4
votes
1answer
652 views

Why aren't telnet bots finishing the three-way handshake?

I have a port forwarding rule sending 23 traffic to a "honeypot" (called "comp" below). Throughout the night, many bots from around the world attempted to connect, but there was no service running. ...
-4
votes
1answer
738 views

Explanation of Honeypot diagram

Can someone please give me an exact explanation of what is happening in the diagram below? I have tried to find a diagram explaining the honeypot process but I can't seem to find a clear explanation. ...
33
votes
8answers
8k views

Giving malicious crawlers and scripts a hard time

My webserver has been up for < 25 hours and has already been crawled for various default pages, just to name one /administrator/index.php. I understand that this is very common and it's not really ...
9
votes
1answer
428 views

Fingerprint ssh attack tool

I noticed a high volume of SSH password attempts on my server and installed the Cowrie honeypot to see what the attacker(s) would do if they actually got access. I've identified consistent patterns ...
-5
votes
1answer
186 views

how can one find the honeypot [closed]

how can one find the honeypot while want to observe the other hackers.
2
votes
1answer
550 views

Is it a good approach to deploy a honeypot behind the firewall

I am using a linux box as a firewall and router. I would install a system running honeypots like kippo, dionaea or glastopf behind it. My honeypot is on private IP and all required ports are being ...
0
votes
1answer
270 views

Decoding Honeypot Payload

Apologies for the basic question. I have searched, but I had trouble even determining search terms. I set up a Cowrie honeypot (SSH/Telnet) last night on a VPS. I find this in the cowrie log today. ...
3
votes
2answers
2k views

Would I create a WiFi honeypot by setting up a fake network with a generic name like “linksys”?

On this page Apple says the following: SSID (Service Set Identifier—Wi-Fi network name) The SSID, or network name, identifies your Wi-Fi network to users and other Wi-Fi devices. It is case ...
3
votes
2answers
545 views

How far is honeypot legal? [closed]

I have reasons to think that my private message are watched by the site's support that I'm on. This is legal due to the TOS I had to valid when I subscribed to this website. Howewer, I would like to ...
0
votes
2answers
722 views

Configure http honeypot on my ubuntu server [closed]

I want to configure an http honeypot on my ubuntu server. I am using apache web server. I am thinking to set 80 port for the honeypot and some other unusual port like 8978 or 6723 for my site. I will ...
17
votes
2answers
10k views

How to force clients to connect to WiFi automatically?

I have watched a hak5 YouTube that they did make people connect to their wifipineapple (a WiFi Honey pot) , and they stored the Wi-Fi hotspots, those the phone used to connect to. The historical ...
4
votes
0answers
299 views

Preventing Dionaea Service Identification

I've been working on trying to prevent Dionaea service identification using articles such as this. I've managed to disguise most of the ports that dionaea utilizes. However, when scanning with nmap, ...
2
votes
0answers
205 views

Are there public honeypot logs that I can look at? [closed]

Is there a place online where I can see other's honeypot logs and what kind of activities those hackers were up to?
0
votes
2answers
401 views

Setting up a secure VM and protecting host network

I'm an intern doing research on different honeypots, and I'm planning to test a few on a VM. However, I'm on a company network and would like to have my VM as secure as possible. I've read that VMs ...
0
votes
1answer
167 views

Add new vulnerabilty module on honeypot dionaea

I want to install dionaea but i am not sure about it's capability to collect modern malware. I see that it use old vulnerabilities modules. My questions are: 1) It is possible to add new ...
18
votes
5answers
548 views

Is there a place where I can upload my honeypot logs to?

Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of ...
1
vote
0answers
65 views

Honeypot Configuration - Alerting with Mandrill

Has anyone connected the OpenCanary Honeypot Correlator to Mandrill? There is a section of the opencanary_correlator.conf file that allows for the Mandrill API key but for no other configuration. How ...
3
votes
3answers
85 views

Collect infected email attachments

I am having catch-all mailboxes for a lot of domains. The mails I receive for them are either spam or have viruses or trojans attached. So far I am just throwing them away, but I wondered if it wasn'...
4
votes
1answer
1k views

What is a decoy-server?

I see that the term "decoy-server" is often used but I am not able to find a more formal definition for it. Can someone help? E.g https://scholar.google.com.sg/scholar?hl=en&q=%22decoy+server%22&...
5
votes
2answers
89 views

What are the dangers of exposing weakly protected user accounts bound with a fake shell over ssh?

As anyone running a server can tell from first-hand experience, there are bots trying to constantly brute force their way through with commonly found usernames over SSH. A friend of mine created a ...
0
votes
1answer
227 views

Understand how dionaea honeypot emulated services work

I'm trying to understand Dionaea honeypot and the information flow. I understand that it emulates some services, like SMB, ftp, tftp, try to responde with these, then gets the shellcode and ...
2
votes
1answer
180 views

Detect host lookups against a domain/subdomain name

I want to detect, with as much accuracy as possible, the IP address of any remote host performing a DNS lookup of my domain name (eg. nslookup mydomain123.com) and any subdomains as well if possible. ...
1
vote
0answers
114 views

PGP 'forced entry' decode (steganography?)

This was originally posted by me on stackoverflow but was deemed too generic. It does seem like an impossible thing to do, but: you know when you have your perimeter alarm system you usually get to ...
10
votes
1answer
555 views

How to understand QEBEK (Honeypot Monitoring Tool)? [closed]

I've been trying for some time to find recent or meaningful documentation regarding QEBEK, but all I've found is the Intro and KYT Paper for Installation 2010. The links are just a formal introduction,...
-2
votes
1answer
386 views

Honeypot used as as a proxy?

I'm running Kali Linux on my system at home to practice pentesting. If I implement a honeypot on my system could it be possible to use that as some sort of proxy server? I was thinking it wouldn't be ...