IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [honeypot]

a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

130 questions
34
votes
5 answers

Is a honeypot an effective deterrent to hackers successfully compromising your network?

According to Microsoft, adding a honeypot to your corporate network is an effective way to deter hackers from compromising your network. Aren't honeypots more for research purposes and not ideal for corporate networks? Wouldn't having a honeypot on…
Jason
  • 3,086
  • 4
  • 20
  • 24
33
votes
8 answers

Giving malicious crawlers and scripts a hard time

My webserver has been up for < 25 hours and has already been crawled for various default pages, just to name one /administrator/index.php. I understand that this is very common and it's not really an issue for me, as I have secured the server in a…
SaAtomic
  • 989
  • 2
  • 15
  • 27
27
votes
6 answers

How can I get more spam for my honeypot?

Spam is everywhere and everyone gets it (especially professors), but I noticed that my personal email does not get much spam. How can I get more? What are the most common ways of getting spam? Not just by forgetting to unsubscribe from a mailing…
Marcus
  • 1,145
  • 1
  • 8
  • 12
26
votes
4 answers

Is it possible to detect a honeypot?

Do techniques exists to know if a machine is a honeypot (or suspicious indicators)? What techniques can be used for a software inside the honeypot or outside it? What techniques uses malware to prevent infecting honeypot?
wjaphqoz
  • 263
  • 1
  • 3
  • 4
25
votes
4 answers

Honeypot on home network to help me learn

I'm a pretty decent (IMO) web app penetration tester, but I'm eager to expand my knowledge of other areas of security. Given that I've just taken on something of an enhanced sysadmin role at my work, I figured it would be a pretty good opportunity…
Chris Allen Lane
  • 1,037
  • 1
  • 10
  • 13
23
votes
3 answers

Can someone get my WPA2 password with honeypots?

Yesterday I went to my cousin's home and I saw that I'm not connected to his wireless (for internet access). Then I have looked up the list of wireless points. I have found his name and clicked it connect, I have entered his password (which I know)…
ilhan
  • 415
  • 2
  • 4
  • 10
18
votes
3 answers

Recommendations for honeypot software

A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction honeypot. Also we'd like to eventually report the…
Lizbeth
  • 757
  • 6
  • 14
18
votes
5 answers

Is there a place where I can upload my honeypot logs to?

Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of automated scans, some interesting RFI / RCE attempts…
vladimir
  • 341
  • 1
  • 2
  • 6
18
votes
3 answers

Setting up a honeypot

I have a spare computer lying around at my house, so I decided to turn it into a honeypot. So far, I have installed Windows XP (no service pack) on it and have set up rules on my router to forward (some) ports to the honeypot. Since my router…
ryyst
  • 281
  • 1
  • 2
  • 4
17
votes
2 answers

How to force clients to connect to WiFi automatically?

I have watched a hak5 YouTube that they did make people connect to their wifipineapple (a WiFi Honey pot) , and they stored the Wi-Fi hotspots, those the phone used to connect to. The historical hotspots are many. I am wondering how they made it. If…
dotslash
  • 387
  • 3
  • 4
  • 13
15
votes
4 answers

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an application which works to handle brute force SSH attacks. I…
citruspi
  • 315
  • 2
  • 7
14
votes
2 answers

Profiling hackers with keystroke dynamics

I am writing a research paper on tracking hackers and how to include keystroke timings to create a profile of hackers. I want to combine the keystroke timings that I capture in ttylog with other data from sessions, like IP address, type of attack,…
user13959
  • 141
  • 2
12
votes
2 answers

Does WPA2 Enterprise mitigate evil twin attacks?

One of the dangers of using WPA2-PSK is the possibility that an attacker may setup another wireless network with the same SSID and even use the same access point MAC address via MAC spoofing. The attacker then may use a deauth attack to cause an…
Naftuli Kay
  • 6,715
  • 9
  • 47
  • 75
12
votes
4 answers

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that actually contains the real password and n-1 that…
magnattic
  • 335
  • 2
  • 13
10
votes
2 answers

Using "canaries" to detect intrusion?

I haven't read much about such a technique, but I'm wondering if there's any sort of best practice around the use of "canaries" to detect certain types of intrusion: Create a bogus account that should never be logged in -- if someone attempts to…
bstpierre
  • 4,868
  • 1
  • 21
  • 34
1
2 3
…
8 9