Questions tagged [honeypot]

a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

1
vote
1answer
115 views

Honeypot for Linux user

Let's consider the following scenario: You have a web -facing server, which runs software e.g. apache2 on separate Linux user www-data. An attacker finds a vulnerability and gets a remote shell on ...
1
vote
1answer
139 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
-2
votes
2answers
141 views

Honeypot detection: How is TCP/IP implemented on honeypots?

I'm currently studying how to do honeypot detection and was wondering if a possible lead is to analyse how honeypots implement their TCP/IP protocol. I've been looking through the source code for a ...
2
votes
1answer
86 views

Concerning The OWASP Security Guidelines As They Apply To Site Registration / Could honeypotting work?

I'm tossing an idea around in my mind. I want to bounce it off the community to see if this holds any water. First - the OWASP guidelines never specify any method of action when you're dealing with ...
2
votes
1answer
127 views

Honeypot SSH connection attempts with no interaction

I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect. I'm thinking this is ...
1
vote
0answers
104 views

How to get malware campaign runners to use my mail honeypot?

I have a working mail honeypot but have yet to receive any malware. I've already tried submitting my domain to several unsubscribe forms, but it does not seem to have worked. Any suggestions would be ...
0
votes
1answer
132 views

Cowrie as a decoy on production server: is it a good idea?

I'm considering setting up a SSH honeypot listening on port 22 on my production servers. I'm hoping that not getting an immediate Connection refused would slow down potential attackers. Are there any ...
0
votes
0answers
259 views

What are all of these IPs addresses? Honeypots?

I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
1
vote
1answer
118 views

Is there any interest in purchasing honeypot traffic data?

A friend of mine asked me this recently, and besides the obvious "try with antivirus vendors" I didn't know what to answer. He's been building a pretty large collection of data from a honeynet ...
1
vote
1answer
135 views

scada honeypot guide help

With the recent vpn filter attacks, and talks about the hackers wanting to attack our SCADA systems in the U.S. I want to setup a honeypot to monitor the attackers and learn more about how they ...
-2
votes
2answers
111 views

Any honeypot available to run webservice

I'm new to honeypots. I wanted to know if there are any honeypot platform for hosting my own webservice? I came across glasstopf but I read that it emulates its own web app.
4
votes
2answers
1k views

How to safely create a “honeypot (linux) user”

Would following be a feasible security feature to detect attempts? Creating a user with following specs: Username admin Password fairly insecure (not 123456, but a dictonary word) Special ...
1
vote
0answers
53 views

Honeypot confused where to deploy [duplicate]

Planning to deploy honeypot dionaea. Where should I deploy it? Google cloud (free trial) Raspberry pi (internal network) My home network is: router------ddwrt------raspberry pi (honeypot) And on ...
1
vote
0answers
277 views

redirect connection to honeypot service [closed]

i am currently redirecting attackers to themselves based on a few rules <iptables> -t nat -A PREROUTING -s <ip> -j DNAT --to-destination <ip> i was thinking that maybe it could be ...
1
vote
1answer
246 views

Additional risks to home network in exposing (raspberry pi) honeypot to the internet

While I would like to contribute piping of logs from a home-deployed honeypot to the DSHIELD project using a raspberry pi, I am concerned that the additional exposure of the port to the internet would ...
0
votes
2answers
217 views

Do the 'bad guys' create honeypots?

I know companies, governments, and other organizations create honeypots (ex: SQLi pages, Open Access Points, Open Ports, etc.) to lure in the bad guys. Are there any examples of the bad guys creating ...
4
votes
1answer
2k views

The Shadow Server Foundation constantly trying to get access to mDNSResponder

Update September 2018: The events described below still happen to this day though less often from servers of The Shadow Server Foundation. By now I have denied access to most of their IP addresses, ...
1
vote
0answers
116 views

Splunk integration with HoneyD [closed]

In a previous thread someone mentioned about HoneyD causing logs to fill up too fast, there was a comment posted about using splunk. I am very interested in how to integrate HoneyD with Splunk, it ...
1
vote
2answers
207 views

Can a honeypot really deflect damage back to the attacker?

The honeypot wikipedia article states: ...a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. ...
1
vote
1answer
741 views

Honeypot tricking my android device to connect

I have been facing this issue since a month where a neighbour access point is acting like a honeypot, all the nearby android devices are getting connected to it even after forgetting the network. The ...
0
votes
1answer
223 views

False, honeypot like wifi

I have set cameras for security at home, because someone broke into my house. As the suspect doesnt want to give up (got a mail from him, lol), I want to find more info about him. Because cameras are ...
1
vote
2answers
108 views

How to Store malware executables?

I have been developing a simple honeypot system. Configuration of the honeypot system is : 1. Main router R has two parts: part A and B. 2. Part A is turned off and part B is set as a DMZ with a ...
1
vote
0answers
110 views

Signature Generate by Honeyd “Honeycomb” is not accept by Snort IPS

I posted this on SO [https://stackoverflow.com/questions/44652014/signature-generate-by-honeyd-honeycomb-is-not-accept-by-snort-ips] is this on topic here? What would I need to do to my question ? I ...
1
vote
1answer
128 views

Break anonymity in a Kippo honeypot

I've installed a Kippo honeypot on my server and I wanted to know if there are some tools I can launch to collect more information about the cracker. I want more information to be able to start some ...
3
votes
1answer
134 views

What OS should I use for sandboxing/running viruses designed for IoT devices?

I have a telnet and ssh honeypot (more specifically, cowrie). Most viruses I get there are designed for routers, cameras, etc... The virtualization software I am using is VirtualBox, and I am using ...
2
votes
0answers
259 views

Potential Issues and downfalls of the “honeyPot” in asp.net mvc

Within the last few weeks I have been noticing massive amounts of bot traffic coming out of a small geographical area. I have implemented the robots.txt into my ASP.net project, but as I understand it,...
4
votes
2answers
457 views

How relevant is the honeypot technique today?

I have been reading about honeypots and different implementation of them, while some articles are recent most of them are old (more than ten years ago) I was wondering if honeypots are still relevant ...
0
votes
1answer
345 views

Full isolation of a honeypot on a single Internet line?

What happens when you swap a modem and router out with a different modem and router? Can you achieve full isolation by alternating between which network is plugged into the Internet line? I am ...
4
votes
1answer
732 views

Why aren't telnet bots finishing the three-way handshake?

I have a port forwarding rule sending 23 traffic to a "honeypot" (called "comp" below). Throughout the night, many bots from around the world attempted to connect, but there was no service running. ...
-3
votes
1answer
891 views

Explanation of Honeypot diagram

Can someone please give me an exact explanation of what is happening in the diagram below? I have tried to find a diagram explaining the honeypot process but I can't seem to find a clear explanation. ...
33
votes
8answers
9k views

Giving malicious crawlers and scripts a hard time

My webserver has been up for < 25 hours and has already been crawled for various default pages, just to name one /administrator/index.php. I understand that this is very common and it's not really ...
9
votes
1answer
498 views

Fingerprint ssh attack tool

I noticed a high volume of SSH password attempts on my server and installed the Cowrie honeypot to see what the attacker(s) would do if they actually got access. I've identified consistent patterns ...
-4
votes
1answer
218 views

how can one find the honeypot [closed]

how can one find the honeypot while want to observe the other hackers.
2
votes
1answer
617 views

Is it a good approach to deploy a honeypot behind the firewall

I am using a linux box as a firewall and router. I would install a system running honeypots like kippo, dionaea or glastopf behind it. My honeypot is on private IP and all required ports are being ...
0
votes
1answer
289 views

Decoding Honeypot Payload

Apologies for the basic question. I have searched, but I had trouble even determining search terms. I set up a Cowrie honeypot (SSH/Telnet) last night on a VPS. I find this in the cowrie log today. ...
3
votes
2answers
3k views

Would I create a WiFi honeypot by setting up a fake network with a generic name like “linksys”?

On this page Apple says the following: SSID (Service Set Identifier—Wi-Fi network name) The SSID, or network name, identifies your Wi-Fi network to users and other Wi-Fi devices. It is case ...
3
votes
2answers
642 views

How far is honeypot legal? [closed]

I have reasons to think that my private message are watched by the site's support that I'm on. This is legal due to the TOS I had to valid when I subscribed to this website. Howewer, I would like to ...
0
votes
2answers
802 views

Configure http honeypot on my ubuntu server [closed]

I want to configure an http honeypot on my ubuntu server. I am using apache web server. I am thinking to set 80 port for the honeypot and some other unusual port like 8978 or 6723 for my site. I will ...
17
votes
2answers
11k views

How to force clients to connect to WiFi automatically?

I have watched a hak5 YouTube that they did make people connect to their wifipineapple (a WiFi Honey pot) , and they stored the Wi-Fi hotspots, those the phone used to connect to. The historical ...
4
votes
0answers
333 views

Preventing Dionaea Service Identification

I've been working on trying to prevent Dionaea service identification using articles such as this. I've managed to disguise most of the ports that dionaea utilizes. However, when scanning with nmap, ...
2
votes
0answers
230 views

Are there public honeypot logs that I can look at? [closed]

Is there a place online where I can see other's honeypot logs and what kind of activities those hackers were up to?
0
votes
2answers
484 views

Setting up a secure VM and protecting host network

I'm an intern doing research on different honeypots, and I'm planning to test a few on a VM. However, I'm on a company network and would like to have my VM as secure as possible. I've read that VMs ...
0
votes
1answer
172 views

Add new vulnerabilty module on honeypot dionaea

I want to install dionaea but i am not sure about it's capability to collect modern malware. I see that it use old vulnerabilities modules. My questions are: 1) It is possible to add new ...
18
votes
5answers
629 views

Is there a place where I can upload my honeypot logs to?

Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of ...
1
vote
0answers
68 views

Honeypot Configuration - Alerting with Mandrill

Has anyone connected the OpenCanary Honeypot Correlator to Mandrill? There is a section of the opencanary_correlator.conf file that allows for the Mandrill API key but for no other configuration. How ...
3
votes
3answers
89 views

Collect infected email attachments

I am having catch-all mailboxes for a lot of domains. The mails I receive for them are either spam or have viruses or trojans attached. So far I am just throwing them away, but I wondered if it wasn'...
4
votes
1answer
1k views

What is a decoy-server?

I see that the term "decoy-server" is often used but I am not able to find a more formal definition for it. Can someone help? E.g https://scholar.google.com.sg/scholar?hl=en&q=%22decoy+server%22&...
5
votes
2answers
92 views

What are the dangers of exposing weakly protected user accounts bound with a fake shell over ssh?

As anyone running a server can tell from first-hand experience, there are bots trying to constantly brute force their way through with commonly found usernames over SSH. A friend of mine created a ...
0
votes
1answer
238 views

Understand how dionaea honeypot emulated services work

I'm trying to understand Dionaea honeypot and the information flow. I understand that it emulates some services, like SMB, ftp, tftp, try to responde with these, then gets the shellcode and ...
2
votes
1answer
185 views

Detect host lookups against a domain/subdomain name

I want to detect, with as much accuracy as possible, the IP address of any remote host performing a DNS lookup of my domain name (eg. nslookup mydomain123.com) and any subdomains as well if possible. ...