Skip to content

Latest commit

 

History

History
120 lines (118 loc) · 16 KB

honeypot.md

File metadata and controls

120 lines (118 loc) · 16 KB
Raw

Honeypots

https://github.com/4sp1r3/honeytrap * sshesame * A fake SSH server that lets everyone in and logs their activity

  • General
    • 101
      • Honeypot Computing - Wikipedia
      • The Honeynet Project
        • The Honeynet Project is a leading international 501c3 non-profit security research organization, dedicated to investigating the latest attacks and developing open source security tools to improve Internet security. With Chapters around the world, our volunteers have contributed to fight against malware (such as Confickr), discovering new attacks and creating security tools used by businesses and government agencies all over the world. The organization continues to be on the cutting edge of security research by working to analyze the latest attacks and educating the public about threats to information systems across the world.
      • Honeypots - ShadowServer
      • Types of Honeypots
        • Zero Interaction(Think Passive)
        • Low Interaction(Think canned, limited responses to incoming data
        • Medium/High Interaction(Think Emulating Graphical Services/Providing Continual Content)
        • HoneyData - Strings, shares/drives, etc.
    • Articles/Papers/Talks/Writeups
      • Deploying Dionaea on a Raspberry Pi using MHN
      • Experimenting with Honeypots Using The Modern Honey Network
      • Building a Honeypot to Research Cyber-Attack Techniques
      • Lessons Learn from attacks on Kippo honeypots
      • An in-depth analysis of SSH attacks on Amazon EC2
        • The research study investigates Secure Shell (SSH) attacks on Amazon EC2 cloud instances across different AWS zones by means of deploying Smart Honeypot (SH). It provides an in-depth analysis of SSH attacks, SSH intruders profile, and attempts to identify their tactics and purposes.
      • Analysis of Attacks Using a Honeypot - Verlag Berlin Heidelberg 2011
        • Abstract. A Honeypot is a software based security device, deployed to attract hackers by displaying services and open ports which are potentially vulnerable. While the attackers are diverted, t heir activities can then be monitored and an a- lysed to identify current a ttack methods and trends. A low - interaction Honeypot called Dion aea was chosen for this project because it can simulate services while preventing an attacker from gaining full control. Results were collected over the six week period of the experiment. The logged information of the o b- served attacks was analysed and compared with current vulnerabilities, the loc a- tions where the attacks were originating from and the time of day at the orig i- nating site. A profile of individual attackers can then be built to ga in an insight into the current attack trends in order to improve network defences.
      • POSTER: Dragging Attackers to Honeypots for Effective Analysis of Cyber Threats
      • Setting Honeytraps with Modsecurity - Adding fake hidden form fields
      • Honeypots for Active Defense - A Practical Guide to Deploying Honeynets Within the Enterprise - Greg Foss
        • InfoSec analysts are all somewhat familiar with honeypots. When they are given the proper attention, care and feeding, they produce invaluable information. This intelligence has been primarily used by security researchers and organizations with advanced defensive capabilities to study their adversaries and learn from their actions. But what about the rest of us? Honeypots are a lot of work to configure, maintain, and monitor -- how can an organization that is not focused on research gain valuable intelligence using honeypots and actively defend their network using the data obtained? The answer is honeypots for active defense. There are currently many open source security tool distributions that come pre-loaded with honeypots among other useful tools, however the honeypot software is often not deployed in an effective manner. This session will discuss techniques to deploy honeypots in ways that will not overburden the security team with massive logs to sift through and focuses on correlating active threat data observed in the honeypot with the production environment. When deploying honeypots effectively, this can give security analysts one additional mechanism to tip them off to nefarious activity within their network.
      • Global Honeypot Trends - Elliot Brink
        • Many of my computer systems are constantly compromised, attacked, hacked, 24/7. How do I know this? I've been allowing it. This presentation will cover over one year of research running several vulnerable systems (or honeypots) in multiple countries including the USA, mainland China, Russia and others. We'll be taking a look at: a brief introduction to honeypots, common attacker trends (both sophisticated and script kiddie), brief malware analysis and the statistical analysis of attackers based on GeoIP. Are there differences in attacks based on where a computer system is located? Let's investigate this together! Beginners to the topic of honeypots fear not, the basics will be covered.
      • Security Onions and Honey Potz - Ethan Dodge - BSidesSLC2015
  • Miscellaneous
  • Tools
    • General
      • Introduction to T-Pot - The all in one honeypot - northsec.tech
      • Modern Honey Network(MHN)
        • From the secure deployment to the aggregation of thousands of events MHN provides enteprise grade management of the most current open source honeypot software. MHN is completely free open source software which supports external and internal honeypot deployments at a large and distributed scale. MHN uses the HPFeeds standard and low-interaction honeypots to keep effectiveness and security at enterprise grade levels. MHN provides full REST API out of the box and we are making CEF and STIX support available now for direct SIEM integration through our Commercial platform Optic.
        • Honeypot Farming: Setup Modern Honey Network
      • Beeswarm
        • Beeswarm is a honeypot project which provides easy configuration, deployment and management of honeypots. Beeswarm operates by deploying fake end-user systems (clients) and services (honeypots). Beeswarm uses these systems to provides IoC (Indication of Compromise) by observing the difference between expected and actual traffic.
        • Github
      • Honeywall Project
        • The goal of this page is to provide you the latest documentation, source code, distribution, and information for the Honeynet Project's Honeywall CDROM. The Honeywall CDROM is a bootable CD that installs onto a hard drive and comes with all the tools and functionality for you to implement data capture, control and analysis.
      • dionea
        • dionaea intention is to trap malware exploiting vulnerabilities exposed by services offerd to a network, the ultimate goal is gaining a copy of the malware.
      • Glastopf Project
        • Glastopf is a Honeypot which emulates thousands of vulnerabilities to gather data from attacks targeting web applications. The principle behind it is very simple: Reply the correct response to the attacker exploiting the web application. The project has been kicked off by Lukas Rist in 2009 and the results we are got during this time are very promising and are an incentive to put even more effort in the development of this unique tool. Read the tool description for further information. We are working together with different people, organizations and institutions to get the best from the collected data. Find out more about collaborating with the project.
      • Amun
        • Amun is a low-interaction honeypot, like Nepenthes or Omnivora, designed to capture autonomous spreading malware in an automated fashion. Amun is written in Python and therefore allows easy integration of new features.
        • Amun Honeypot - Github
        • Amun Honeypot Paper
      • Portspoof
        • The Portspoof program primary goal is to enhance your systems security through a set of new camouflage techniques. As a result of applying them your attackers' port scan result will become entirely mangled and to very significant extent meaningless.
      • Opens all ports, hosts seemingly legitimate services on each.
      • Honeytrap
        • Honeytrap is an extensible and opensource system for running, monitoring and managing honeypots.
    • HoneyTokens
      • SPACECRAB
        • Bootstraps an AWS account with everything you need to generate, mangage, and distribute and alert on AWS honey tokens. Made with breakfast roti by the Atlassian security team.
      • DCEPT
        • A tool for deploying and detecting use of Active Directory honeytokens
    • Java Apps
      • Honeyagent
        • HoneyAgent is a Java agent library that creates a Sandbox for Java applications and applets. Therefore, it uses the JVMTI as well as the JNI to intercept class loading and function calls. During runtime HoneyAgent traces function calls from the analysed application. It is displayed which class calles which function with which parameters. Reflected function calls are translated to the original function names for simpler reading.
    • Low-Interaction
    • Service Simulators
      • iNetSim
        • INetSim is a software suite for simulating common internet services in a lab environment, e.g. for analyzing the network behaviour of unknown malware samples.
    • Single Purpose Emulation
      • PHP-ShockPot
        • PHP-ShockPot is a small honeypot aimed at showing you the interesting attempts made trying to exploit your host using the now famous "Shellshock" (also known as bashbug) bug.
      • HoneyBadger
        • A framework for targeted geolocation.
      • elastichoney0
        • Elastichoney is a simple elasticsearch honeypot designed to catch attackers exploiting RCE vulnerabilities in elasticsearch.
    • SSH
      • PSHITT
        • pshitt (for Passwords of SSH Intruders Transferred to Text) is a lightweight fake SSH server designed to collect authentication data sent by intruders. It basically collects username and password used by SSH bruteforce software and writes the extracted data to a file in JSON format. pshitt is written in Python and use paramiko to implement the SSH layer.
      • Kippo
        • Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.
    • Search Engine
      • Google Hack Honeypot GHH
        • Google Hack Honeypot is the reaction to a new type of malicious web traffic: search engine hackers. GHH is a “Google Hack” honeypot. It is designed to provide reconaissance against attackers that use search engines as a hacking tool against your resources. GHH implements honeypot theory to provide additional security to your web presence. Google has developed a powerful tool. The search engine that Google has implemented allows for searching on an immense amount of information. The Google index has swelled past 8 billion pages [February 2005] and continues to grow daily. Mirroring the growth of the Google index, the spread of web-based applications such as message boards and remote administrative tools has resulted in an increase in the number of misconfigured and vulnerable web apps available on the Internet. These insecure tools, when combined with the power of a search engine and index which Google provides, results in a convenient attack vector for malicious users. GHH is a tool to combat this threat.
    • Tarpits
      • Web Labyrinth
        • A simple tool that creates a maze of bogus web pages to confuse web scanners. It's main goal is to delay and occupy malicious scanners that scan websites in order for incident handlers to detected and respond to them before damage is done.
    • USB
    • Web
      • Thug - Python low-interaction honeyclient
        • Thug is a Python low-interaction honeyclient aimed at mimicing the behavior of a web browser in order to detect and emulate malicious contents.
      • Wordpot
        • Wordpot is a Wordpress honeypot which detects probes for plugins, themes, timthumb and other common files used to fingerprint a wordpress installation.
      • phpmyadmin_honeypot
        • Probably one of the smallest and simplest web honeypots out there...
      • Web Bug Server
        • Easily embed a web bug inside word processing documents. These bugs are hidden to the casual observer by using things like linked style sheets and 1 pixel images.
      • honeyLambda
        • a simple, serverless application designed to create and monitor URL {honey}tokens, on top of AWS Lambda and Amazon API Gateway
    • Windows-based
      • Omnivora
        • Omnivora is a low-interaction honeypot for systems running Windows operating systems and is implemented using Borland Delphi. It is primarily designed to collect autonomous spreading malware.
    • Wireless
      • romanHunter
        • romanHunter (router man Hunter) is a wireless honeypot or closer to a sinkhole that will bait a cracker, capture the MAC address, reset the WIFI password (effectively destroying their connection) and wait for the next authorized connection. The password changes happen on a round robin basis from entries in the password file (pw_list.txt).
  • Integration with Other Tools
  • Miscellaneous