Questions tagged [honeypot]
a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system
136
questions
0
votes
2
answers
91
views
Hosting a Honeypot to collect data [closed]
I want to collect IoT botnets in order to analyze them. Are there any good VPS providers who allow to do that? - I'm a little cautious about this because of possible misconfigurations that could ...
- 3
0
votes
1
answer
71
views
Attract Traffic on my Honeypot [duplicate]
I have deployed a low-interaction honeypot on my ec2 aws instance but I am not receiving any traffic. Where can I share the URL so that I can get more traffic especially from automated bots.
- 1
0
votes
0
answers
66
views
Does NMAP detect SecurityOnion honeypots?
I'm installing SecurityOnion Intrusion Detection Honeypot. Does NMAP recognise it as CentOS7 or it might give a hint to the hacker that it is a security onion machine build?
Does SecurityOnion have ...
- 111
0
votes
0
answers
55
views
Low interactive honeypot - how many fake services should i use
I would like to ask for some tips and your own experience. I want to try build some low-interactive honeypot, but I don't know how many services should I run on it or what is suitable to have on this ...
- 162
1
vote
0
answers
25
views
Receive more spam emails [duplicate]
Out of curiosity I want my email address to receive as much spam as possible.
For this, I have already set up a virtual machine, with a Postfix that has a catch-all user, so I receive every email to ...
- 11
0
votes
0
answers
42
views
How to write separate log files for separate services in dionaea honeypot
I am trying to set up a honeypot service on the network and I installed dionaea honeypot. I figured out that each service is being controlled by yaml files present in /opt/dionaea/etc/dionaea/services-...
0
votes
1
answer
81
views
Honeyd not responding to TCP
I'm having some issues getting Honeyd to work properly on an external network interface on Ubuntu 20 LTS running on a Proxmox server. I'm fairly sure it's a configuration/setup problem on the VM I'm ...
- 1
0
votes
0
answers
64
views
Malware sinkhole evasion techniques
I have read into malware sink holing, as a way to disrupt botnets.
There are also approaches to make this more difficult, for example using a Domain Name Generator algorithm which is what the ...
- 181
0
votes
1
answer
98
views
How would you counter an email/honeypot mischief scenario?
I'm thinking through a mischief denial-of-service scenario that seems too easy to employ.
Your web-site validates email addresses for new users on sign-up.
A rogue party (a competitor) performs sign-...
- 103
28
votes
6
answers
7k
views
How can I get more spam for my honeypot?
Spam is everywhere and everyone gets it (especially professors), but I noticed that my personal email does not get much spam. How can I get more?
What are the most common ways of getting spam? Not ...
- 1,165
1
vote
2
answers
281
views
How is DNS sinkhole being use?
I had some difficulty in grasping the concept on how "DNS sinkhole" is being utilize.
Is it like setting up something similar to a honeypot to lure attackers away from the actual network, so ...
0
votes
0
answers
154
views
How to Minimize Risk of Remote Access from Potential Job Scam?
Question resolved: no reason at this time to assume the remote access was with any malicious intent.
[skip this beginning if you want]
My partner was offered a job with a real estate listing company ...
0
votes
0
answers
79
views
Detect KPsensor HoneyPot
Is there any pattern or characteristics to identify a kpsensor? It is one of the most used.
I have noticed that of the number of supposedly open ports, only those with a real service running respond ...
1
vote
1
answer
305
views
Is it possible to create a honeytoken as an image file?
I though it would be an interesting idea for my final year project.
A honeypot token in an image form, with a hidden script that will send you information about the user when the file is executed (...
- 11
1
vote
1
answer
281
views
How technically setup an honeypot
When I started reading about honeypots, I could understand what is honeypot, how it works theoretically, i.e it is a trap-network that may or may not mimics a real network, but because of my limited ...
- 33
1
vote
1
answer
173
views
Do blue teams plant CTF like canaries across infrastructure?
I am working on a SaaS application that handles sensitive data. I had the idea of planting various canaries across our application / infrastructure to get early warnings of people being a bit too much ...
- 111
-5
votes
1
answer
483
views
Honeypot for hunting browser zero-days, rootkits and malware [closed]
I would like to create a honeypot (bot) to hunt browser zero-days (and browser extensions). What is the best way to find those 0days automatically (I would like to create a sandboxed bot which would ...
- 582
1
vote
1
answer
326
views
Honeypot for Linux user
Let's consider the following scenario:
You have a web -facing server, which runs software e.g. apache2 on separate Linux user www-data. An attacker finds a vulnerability and gets a remote shell on ...
- 3,813
2
votes
1
answer
650
views
Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?
For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER.
I wanted to find out if there are any benefits of placing WAF ...
- 21
-2
votes
2
answers
587
views
Honeypot detection: How is TCP/IP implemented on honeypots?
I'm currently studying how to do honeypot detection and was wondering if a possible lead is to analyse how honeypots implement their TCP/IP protocol.
I've been looking through the source code for a ...
- 1
2
votes
1
answer
221
views
Concerning The OWASP Security Guidelines As They Apply To Site Registration / Could honeypotting work?
I'm tossing an idea around in my mind. I want to bounce it off the community to see if this holds any water.
First - the OWASP guidelines never specify any method of action when you're dealing with ...
- 189
2
votes
1
answer
261
views
Honeypot SSH connection attempts with no interaction
I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect.
I'm thinking this is ...
- 21
2
votes
0
answers
167
views
How to get malware campaign runners to use my mail honeypot?
I have a working mail honeypot but have yet to receive any malware. I've already tried submitting my domain to several unsubscribe forms, but it does not seem to have worked. Any suggestions would be ...
- 21
0
votes
1
answer
375
views
Cowrie as a decoy on production server: is it a good idea?
I'm considering setting up a SSH honeypot listening on port 22 on my production servers. I'm hoping that not getting an immediate Connection refused would slow down potential attackers.
Are there any ...
- 163
0
votes
0
answers
700
views
What are all of these IPs addresses? Honeypots?
I was scanning my network (192.168.0.1-100) and I found many IP addresses that are not mine nor known, around 800 of them. I guess it has something to do with the ISP. After scanning the ips with nmap ...
- 172
1
vote
1
answer
228
views
Is there any interest in purchasing honeypot traffic data?
A friend of mine asked me this recently, and besides the obvious "try with antivirus vendors" I didn't know what to answer.
He's been building a pretty large collection of data from a honeynet ...
- 11
1
vote
1
answer
232
views
scada honeypot guide help
With the recent vpn filter attacks, and talks about the hackers wanting to attack our SCADA systems in the U.S. I want to setup a honeypot to monitor the attackers and learn more about how they ...
- 41
-2
votes
2
answers
190
views
Any honeypot available to run webservice
I'm new to honeypots. I wanted to know if there are any honeypot platform for hosting my own webservice? I came across glasstopf but I read that it emulates its own web app.
4
votes
2
answers
2k
views
How to safely create a "honeypot (linux) user"
Would following be a feasible security feature to detect attempts?
Creating a user with following specs:
Username admin
Password fairly insecure (not 123456, but a dictonary word)
Special permissions:...
- 819
1
vote
0
answers
62
views
Honeypot confused where to deploy [duplicate]
Planning to deploy honeypot dionaea. Where should I deploy it?
Google cloud (free trial)
Raspberry pi (internal network)
My home network is: router------ddwrt------raspberry pi (honeypot)
And on ...
- 11
2
votes
0
answers
628
views
redirect connection to honeypot service [closed]
i am currently redirecting attackers to themselves based on a few rules
<iptables> -t nat -A PREROUTING -s <ip> -j DNAT --to-destination <ip>
i was thinking that maybe it could be ...
- 121
1
vote
1
answer
492
views
Additional risks to home network in exposing (raspberry pi) honeypot to the internet
While I would like to contribute piping of logs from a home-deployed honeypot to the DSHIELD project using a raspberry pi, I am concerned that the additional exposure of the port to the internet would ...
- 739
0
votes
2
answers
289
views
Do the 'bad guys' create honeypots?
I know companies, governments, and other organizations create honeypots (ex: SQLi pages, Open Access Points, Open Ports, etc.) to lure in the bad guys. Are there any examples of the bad guys creating ...
- 35
4
votes
1
answer
5k
views
The Shadow Server Foundation constantly trying to get access to mDNSResponder
Update September 2018: The events described below still happen to this day though less often from servers of The Shadow Server Foundation. By now I have denied access to most of their IP addresses, ...
- 185
1
vote
0
answers
178
views
Splunk integration with HoneyD [closed]
In a previous thread someone mentioned about HoneyD causing logs to fill up too fast, there was a comment posted about using splunk.
I am very interested in how to integrate HoneyD with Splunk, it ...
- 11
1
vote
2
answers
368
views
Can a honeypot really deflect damage back to the attacker?
The honeypot wikipedia article states:
...a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems.
...
1
vote
1
answer
1k
views
Honeypot tricking my android device to connect
I have been facing this issue since a month where a neighbour access point is acting like a honeypot, all the nearby android devices are getting connected to it even after forgetting the network.
The ...
- 123
0
votes
1
answer
314
views
False, honeypot like wifi
I have set cameras for security at home, because someone broke into my house. As the suspect doesnt want to give up (got a mail from him, lol), I want to find more info about him. Because cameras are ...
- 272
1
vote
2
answers
226
views
How to store malware executables?
I have been developing a simple honeypot system.
Configuration of the honeypot system is:
Main router R has two parts: part A and B.
Part A is turned off and part B is set as a DMZ with a single PC ...
1
vote
0
answers
200
views
Signature Generate by Honeyd “Honeycomb” is not accept by Snort IPS
I posted this on SO [https://stackoverflow.com/questions/44652014/signature-generate-by-honeyd-honeycomb-is-not-accept-by-snort-ips] is this on topic here? What would I need to do to my question ?
I ...
- 11
1
vote
1
answer
177
views
Break anonymity in a Kippo honeypot
I've installed a Kippo honeypot on my server and I wanted to know if there are some tools I can launch to collect more information about the cracker.
I want more information to be able to start some ...
- 11
3
votes
1
answer
183
views
What OS should I use for sandboxing/running viruses designed for IoT devices?
I have a telnet and ssh honeypot (more specifically, cowrie). Most viruses I get there are designed for routers, cameras, etc...
The virtualization software I am using is VirtualBox, and I am using ...
- 199
2
votes
0
answers
576
views
Potential Issues and downfalls of the "honeyPot" in asp.net mvc
Within the last few weeks I have been noticing massive amounts of bot traffic coming out of a small geographical area. I have implemented the robots.txt into my ASP.net project, but as I understand it,...
- 157
4
votes
2
answers
958
views
How relevant is the honeypot technique today?
I have been reading about honeypots and different implementation of them, while some articles are recent most of them are old (more than ten years ago) I was wondering if honeypots are still relevant ...
- 63
0
votes
1
answer
626
views
Full isolation of a honeypot on a single Internet line?
What happens when you swap a modem and router out with a different modem and router?
Can you achieve full isolation by alternating between which network is plugged into the Internet line?
I am ...
- 157
4
votes
1
answer
1k
views
Why aren't telnet bots finishing the three-way handshake?
I have a port forwarding rule sending 23 traffic to a "honeypot" (called "comp" below). Throughout the night, many bots from around the world attempted to connect, but there was no service running.
...
- 305
-3
votes
1
answer
1k
views
Explanation of Honeypot diagram
Can someone please give me an exact explanation of what is happening in the diagram below? I have tried to find a diagram explaining the honeypot process but I can't seem to find a clear explanation.
...
- 1
33
votes
8
answers
9k
views
Giving malicious crawlers and scripts a hard time
My webserver has been up for < 25 hours and has already been crawled for various default pages, just to name one /administrator/index.php.
I understand that this is very common and it's not really ...
- 1,019
9
votes
1
answer
702
views
Fingerprint ssh attack tool
I noticed a high volume of SSH password attempts on my server and installed the Cowrie honeypot to see what the attacker(s) would do if they actually got access.
I've identified consistent patterns ...
- 301
-5
votes
1
answer
421
views
how can one find the honeypot [closed]
how can one find the honeypot while want to observe the other hackers.
- 1