capturing virus/botnet with honeypot...
Results 1 to 3 of 3

Thread: capturing virus/botnet with honeypot...

  1. #1
    Member
    Join Date
    Oct 2006
    Posts
    63

    capturing virus/botnet with honeypot...

    I've decided to setup a honeypot to capture viruses/botnet to reverse engineer them and getting to know how the work, where they come from etc...for that I setup nepenthes running on ubuntu virtual machine, and I opened a hole on my firewall to that machine, pretty much redirecting all traffic that hits the firewall to the virtual box, in less than 3 hours I started to get hit with what appears to be botnet for DDos from ip address in China, but nepenthes sends the virus to a website for analysis, and the virus is no where to be found in the system.....instead I want to be able to capture and analyze them myself...does anyone know a better way to accomplish this?


    Thanks in advance

  2. #2
    Senior Member t34b4g5's Avatar
    Join Date
    Sep 2003
    Location
    Australia.
    Posts
    2,391

    Post

    Quote Originally Posted by k_tech
    I've decided to setup a honeypot to capture viruses/botnet to reverse engineer them and getting to know how the work, where they come from etc...for that I setup nepenthes running on ubuntu virtual machine, and I opened a hole on my firewall to that machine, pretty much redirecting all traffic that hits the firewall to the virtual box, in less than 3 hours I started to get hit with what appears to be botnet for DDos from ip address in China, but nepenthes sends the virus to a website for analysis, and the virus is no where to be found in the system.....instead I want to be able to capture and analyze them myself...does anyone know a better way to accomplish this?


    Thanks in advance
    Maybe check out a few of the Threads that Soda_Popinsky created.

    Pharming

    SMTP Relay Honeypot Tutorial

    Google Hack Honeypot Results

    Advanced Web Based Honeypot Techniques

    Open proxy honeypots

    Hopefully these linked thread may or maynot be of any use..

  3. #3
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,190
    Hmmm, I guess you haven't got it set up right as it claims to collect malware for you:

    http://nepenthes.mwcollect.org/documentation:readme

    I started to get hit with what appears to be botnet for DDos from ip address in China, but nepenthes sends the virus to a website for analysis, and the virus is no where to be found in the system.
    Why does it "appear to be botnet for DDoS". AFAIK a botnet is simply a collection of compromised machines.............. you can use them for anything you like?

    Strictly speaking, I doubt if it was a "virus", as that sort of activity is a bit too promiscuous for botnets. More likely a worm or trojan from what I have seen over the past months.

    Once again, I would suggest that you recheck the documentation and your settings for nepenthes, as it is certainly supposed to support local capture of malware. Sure, it will also try to send the information back to the project, but that is part of the idea of it?
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

Similar Threads

  1. Custom Web Based Honeypots with GHH
    By Soda_Popinsky in forum The Security Tutorials Forum
    Replies: 1
    Last Post: November 12th, 2008, 09:42 PM
  2. SMTP Relay Honeypot Tutorial
    By Soda_Popinsky in forum The Security Tutorials Forum
    Replies: 18
    Last Post: December 6th, 2005, 09:18 AM
  3. A General Honeypot Tutorial
    By alphabetarian in forum The Security Tutorials Forum
    Replies: 8
    Last Post: December 5th, 2005, 03:44 AM
  4. Advanced Web Based Honeypot Techniques
    By Soda_Popinsky in forum The Security Tutorials Forum
    Replies: 7
    Last Post: August 2nd, 2005, 04:39 PM
  5. Watching Hacker Attack Using Honeypot
    By sweet_angel in forum Firewall & Honeypot Discussions
    Replies: 9
    Last Post: January 23rd, 2003, 09:30 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides