WHAT ARE HONEYPOT.ARE they some type of fake wall to catch hackers? :confused:
AND where can i get one
Printable View
WHAT ARE HONEYPOT.ARE they some type of fake wall to catch hackers? :confused:
AND where can i get one
honeypots are computer that like a trap, exactly like using honey to trap a bear....
they are there un-protected and un-patched to allow intruders to enter a system, this can be for a number of reasons....I.e seeing if your network is being scanned or for reasearch purposes
the honey net project is a good example, there other examples if just a matter of putting a number of tools on a box and monitoring the logs using snort and acid together can be the basis of a honey pot
i2c
You make one dude.
Fake wall? I have windows... Maybe we could place a big RedHat on top as a roof then we could all build a house and live the lives of the peaple on the TV show known as the Real World.
Basicly its a computer thats highly watched over with various sniffers and file/sys auditing. Its not always about intruders... but its often mainly about the tools at hand such as new worms, auto-rooters, & (ect).
so you mean if i put a honey pot up on my computer it will tell me the ip of my atackers then i could do some payback :xbones:
i think that im being atacked(flooded )by some one how can i get there ip
put a firewall on your computer this will then tell you when your computer is being attacked,
good ones free ones include zonealarms and sygate
I know sygate tells you the sort of attack and also allows you to see the ip of the attacker and perform a whois scan.
no offense but from your questions I dont think attacking back is a wise idea, cos he'll grab your ip, report you or other nasty things just do a whois, find the [email protected] and send his ip and what hes doing to you to them and theyll probably boot him off there isp or send him bitchy emails...
i2c
Disturb: I'm sorry.... (ok, I lie too), but you are becoming something of a moron.
You are talking about a honeypot, something you clearly don't understand, yet you think it will help you find the person "flooding" you so you can attack him back!!!! Oh dear... Putting up a honeypot is a lot harder than a whole bunch of other ways of seeing the attempted connections to your machine..... Knock yourself out.... Install Ethereal and capture everything..... Ethereal is _sooooo_ advanced that it can show you the IP address of all packets it sees..... It's what us uber 1337 h@x0r$ use 'cos we can see what he is trying to do too....
Install Ethereal, learn how to use it and when you have mastered reading the packets and being able to make an educated guess about what is going on then come back and ask questions..... Until then you are reading things that you don't "get", you are picking up on "cool" sounding ****, but you are not doing anything to help yourself..... That's not what this place is really about..... There is no "silver bullet" to understanding this stuff..... It takes time, the desire to learn, some ability and a more mature attitude than you have displayed so far.....
I'm not going to neg you 'cos it's saturday..... so I'm automatically in a better mood than usual...... But I probably should.... :eek:
http://www.sosresearch.org/publicati...2honeypots.PDF
Stop thinking about attacking back. If you have a firewall, you should have their IP in your logs. From there you can block and report them. Use the ARIN database, google it, put in their IP, and you will get an abuse email to complain to.
According to my link:
That doc is 2 years old, I'm not sure how the rules have changed.Quote:
There is no legal precedent yet established in regard to
honeypots. The issue of entrapment is relevant if an
attacker is intentionally lured to a honeypot, there must be
no tacit permission to access the system – banners should
be carefully stated and identical on both the production
and honeypot systems.
Who do you think you are, the Punisher? Don't play ping pong when you can take away their paddle. Just contact their network abuse email.Quote:
then i could do some payback
Judging by your question, it's more likely that someone will end up using it as an open relay and spamming the hell out of a bunch of other people. Those people in turn will follow the IP back to you, and you are the one that will be getting the payback...Quote:
so you mean if i put a honey pot up on my computer it will tell me the ip of my atackers then i could do some payback
Honeypots are not something to be messed with if you don't know what you are doing. There are a ton of threads here on the subject, along with many links.
Honeypots are not for getting someones IP (although it is a side effect)..and I doubt you would know what to do with it when you did get it. As TheSpecialist stated, it's more for study of what is new, and studying how attacks work, and how systems are compromised... In some cases, honeypots are set up as a 'protection' (loose term) to keep malfeasants busy with something that looks like an unpatched system, and keeping them out of the henhouse.
Until you have even a basic understanding of packets, and the different protocols, etc, all you are going to do is get yourself in trouble...worse yet, you will get frustrated because you don't know what you are looking at .... you gotta walk before you can fly...But if you are into studying how exploits work, by all means, spend some time reading.... especially if you are interested in incident response... it's much nicer to see what is happening on a 'throw-away" system.
Why do you think you are being flooded? What do you see happening that would lead you to believe this?
ok thanks
i looked on my log and founfd the ip
Well done.....
But I have to ask..... Why didn't you get off your butt and do that in the first place?..... It wasn't all that difficult was it?
You are making white noise.... You know the answer but you just like to hear yourself type???? The basis of computing is to _think_.... If your thought's come up with nothing - research - if research comes up with nothing - ask questions..... You do it the other way round, don't you? It all relies upon you knowing how computers work.... If you don't know, and can't be bothered to find out, then you will _never_ be able to "work it out"....
The "secret" in this world is knowledge, (it's actually the secret in any world). Knowledge doesn't simply come from asking others questions..... It comes from the desire to learn at a level where you do it yourself until you "hit the wall"..... When you do that your questions will be sensible and will elicit useful and sensible responses. Until you demonstrate that you are trying yourself then you won't be able to get useful replies.... Because you won't understand them when they occur.....
Good Luck
Bravo TigerShark..not just good advice for learning computers, but good solid, sensible life advice..
w00t w00t! m4ss1ve r3p3ct!!!Quote:
Tiger Shark: uber 1337 h@x0r$
This week for me seems to be the week of the uber hacker, I had my best mate ask me to hack a hotmail account, I was shocked and disgusted I like computer security but i'd never go near a hotmail account, I mean what is the world coming to! Im only young but so much has changed since 1994 when there werent so many trolls. maybe i wasnt looking in the rite place.....
can we get a forum for trolls? theres one for newbies, but theres loads of newbies with good technical knowledge that ask good sensible questions and do there research first, then theres the minority (slowly becoming the majority?) that take it upon them selves to ask cr*p questions.
anyway rant over and back to my boring coursework (C programming for idiots that ive put off until it needed to me handed it cos its so dull - "calculate the area of a sphere"!!!!!wow complex stuff!!! (sarcasm....))
i2c
edit - oh yea i rapidly pointed them towards eric raymonds excellent text on what a hacker is.
IMHO In a nutshell, people who know how to set up a "real world" honeypot( www.urbandictionary.com ) are not looking to "trap" nor "turn in" a quote attacker. The real objective is to make somthing legit enough, in hopes they, a skilled, deticated and educated attacker will upload his or her personal work & tools to the machine, therefore you obtain undiscovered goodies. And I'll be the first to tell you that when he starts off with a quite scan, they will be able to tell if it's a poorly configured honeypot. Or else why would they risk giving away all of their work. It's all in the config ;), not to mention that the uploader is probably 10 times smarter then the one who configs. IMHO
groovicus, you make a very good point there.Quote:
it's more likely that someone will end up using it as an open relay and spamming the hell out of a bunch of other people
It's got to be very time consuming to try and set one of these things up properly. Even with Snort and other traffic analyzing software setup, I can only imagine that it's still very possible for these honeypots to get hijacked fairly easily (which may even be the intended purpose initially).
With all the spoofing that's going on, the vast amounts of time and effort going into the fingerprinting of attackers, the legal issues, and personal liability issues (like groovicus stated above) how effective are honeypots really? If they are effective but only on a small scale, is it trully worth adding yet another exploitable computer to the internet...on purpose?
I just checked out some stuff on honeypots and found this little article on honeypots and it provides some good descriptions, theory and links, including a link to a free basic honeypot known as Back Officer Friendly.