what honeypots are there?

i can't find any good honeypots w/ google.

Which OS would the honeypot go on? Check out HoneyNet Project has some good resources.

i want it to go on WinXP.

BackOfficer Friendly is a free but simple Windows honeypot. ManTrap by Symantec is a high-end, high cost. Alternatively, you could use something like VMWare to create a medium risk, medium-low cost honeypot.

I've found that on Windows there are few free options for honeypots and mostly high cost options from larger enterprises (Symantec, Computer Associates, etc.).

thanx 4 telling me about backOfficer Friendly

Good Day,

I just happen to have a copy of "Honeypots - Tracking Hackers" on the book shelf and after reading it, I would highly recommend that before you install software for setting up your own honeypot, that you do some studying.

Obviously I don't know your skill set, but better make sure yours is better than the folks you might want to lure in and catch in the honeypot. ;)

Edit: Some links are also listed below the thread.

As Relyt said, pick up a copy of "Honeypots - Tracking Hackers". It's written by Lance Spitzner and is an excellent, excellent book. It's very informative, yet a relatively easy read at the same time. I did an independent study course last year on honeypots and that was the book I used as a text.

While Back Officer Friendly is pretty much the only free Windows honeypot I can think of, it's also incredibly lame. It's a low interaction honeypot, which means that all it does is throw up some open ports and then log whenever anyone connects to them. However, that's *all* it does...where as some low interaction honeypots will emulate a service. Another downside to BOF is that it doesn't take a brain surgeon to ID it. You can connect to it's wanna-be telnet port, type a login and password, but the password shows up as you type it. I've never telnetted into a box where that's happened. Quite honestly, I'd barely say that it was worth a look.

However, if you really want to get into some cool honeypots, use VMWare like Mittens said, but throw a Linux flavor on a virtual machine and then check into either Honeyd (my fav.), LaBrea, or the Deception Tool Kit. I'm pretty sure you may have to compile them from source, I know for a fact Honeyd you will, so you'll need to make sure you have a C compiler installed.

Happy Honeypotting...

Alpha

Hi,

rule #1 DO NOT do this on your main, or a shared computer resource......only use a machine on which you are prepared to reformat and reinstall your OS.

Certainly don't do it on a school, college or work computer :eek:

Honeypots are not beginners' stuff, so make sure that you read up thoroughly ;)

Good luck.............and be careful

i like using the BackOfficer Friendly honeypot. thanx MsMittens.

why aren't there many threads in this section?

Probably because few people use honeypots or have one. ;)

good point. but wouldnt they have spotted it in the forum menu thing??

Even if someone does notice this forum, doesn't mean that they will use it.

but would they get interested and try to find stuff out about honeypots?

Sure. Just because a forum doesn't have 10,000 posts doesn't mean people aren't reading it. The reality is that honeypot usage is still a relatively new thing and I suspect that many either don't have the time or patience to setup up a good honeypot and ensure a limited risk factor. That's life.

There are lots of resources out there for honeypots but I still say the best is http://project.honeynet.org. (whoops! Fixed! :))

That is an invalid link

I experimented with a honeypot called KFSensor from keyfocus http://www.keyfocus.net/kfsensor/

Though I am not very familiar with honeypots nor have I played with KFSensor enough to give a report, I will say it was fun watching the connections come in and the commands that were typed. KFSensor is comercial, a trial is available.

I just found a honeypot (directed from another website): http://www.security-corporation.com/trapserver.html

Looks interesting and it's FREE! :D (gotta love that 4 letter word). So those of you in Windows might want to try it.

Quote:

---

Originally posted here by journy101
Though I am not very familiar with honeypots nor have I played with KFSensor enough to give a report, I will say it was fun watching the connections come in and the commands that were typed. KFSensor is comercial, a trial is available. [/B]

---

I use kfsensor. I agree on the watching connections bit. Mostly it runs as a spam trap and that isnt wildly interesting.

I caught someone trying to send fake aol billing messages from a russian ISP once, and another person trying to exploit yahoo pager. I keep hoping I might catch something from these new trojans but without a proper simulator behind the ports there isnt much hope I think.