|
-
April 3rd, 2003, 02:16 PM
#1
HoneyPot? Prolly not...
Hey guys/gals,
> i'm writing a simple application that logs all socket requests on certain ports... i've included the log file it currently creates from port 80 traffic... What other info about the attacker/client would be useful? thank you in advance...
yeah, I\'m gonna need that by friday...
-
April 3rd, 2003, 02:48 PM
#2
Re: HoneyPot? Prolly not...
Originally posted here by tampabay420
Hey guys/gals,
> i'm writing a simple application that logs all socket requests on certain ports... i've included the log file it currently creates from port 80 traffic... What other info about the attacker/client would be useful? thank you in advance...
How about the (extra) http headers and POST/GET data?
-
April 3rd, 2003, 03:06 PM
#3
i just took all of that out... as all of that data can be forged quite easily...
i'm really only interested what/where the would-be attacker is doing?
thanks...
yeah, I\'m gonna need that by friday...
-
April 3rd, 2003, 03:08 PM
#4
Originally posted here by tampabay420
i just took all of that out... as all of that data can be forged quite easily...
i'm really only interested what/where the would-be attacker is doing?
thanks...
That's why the headers and the data is important. Most exploits are hidden in this data.
As an example here's a Code Red I captured using nothing more than nc -l -p 80 > codered.txt .
-
April 3rd, 2003, 03:32 PM
#5
Here is the new Log example
yeah, I\'m gonna need that by friday...
-
April 3rd, 2003, 03:33 PM
#6
-
April 3rd, 2003, 03:52 PM
#7
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|
Reply With Quote
)
