Printable View
i'm such a n00b, but what are the names of the computers/competitions when people have put a computer on the internet to get hacked, win points, no DDOS/DOS, etc........they are not called warpots, and I have seen posts on here about them. FOR the life of me, I can't remember what they are called..........thankx in advance
Welcome,
They are called "wargames", you are confusing them with "honeypots" which are used to trap hackers. Or at leatst find out what they are getting up to.
:D
i have always wondered the mystery about honeypots :rolleyes: ...like how they are used, when they are used, why they are used
The mystery? IMO they work similiar to that of a firewall IMO. However in a different preset, like routers and hardware firewall's. You should look up the subject "Honeypot's" and learn about it, quite interesting if your into security.
Ummm...Quote:
IMO they work similiar to that of a firewall IMO.
Not really? They usually work w/o a firewall unless the firewall is being monitored for penetration as well? Remember, the point of a honeypot is to be victimized by a zeroday and be able to monitor it, so it would have a firewall blocking outbound connections but not inbound allow a zeroday to be received but to prevent that zeroday from jumping elsewhere? Honeypots and firewalls, big difference?
[offtopicdontrespond]COLLEGIATE DODGEBALL STARTS TODAY[/offtopicdontrespond]
Back on topic:
http://www.antionline.com/showthread...647#post787145
Soda_Popinsky: My main point was that they can work together to stop/detect/moniter an enemy.
Spyder, I suppose your right to a certain extent, but you wouldn't use the firewall to block very many ports. I suppose the only reason you would use a firewall with a honeypot is the intrusion notification or something of that sort, you might block certain ports that some worms attack, after all, you don't want your honeypot destroyed. Other then those reasons, a firewall doesn't serve much more of a purpose. Remember, the whole purpose for a honeypot is to let the intruder in and monitor...
It wouldn't work if you blocked all outgoing... Think simple ICMP... 3 way handshake.. The sender has to get his response back or he will never know he has any control...Quote:
Originally posted here by Soda_Popinsky
Ummm...
Not really? They usually work w/o a firewall unless the firewall is being monitored for penetration as well? Remember, the point of a honeypot is to be victimized by a zeroday and be able to monitor it, so it would have a firewall blocking outbound connections but not inbound allow a zeroday to be received but to prevent that zeroday from jumping elsewhere? Honeypots and firewalls, big difference?
[offtopicdontrespond]COLLEGIATE DODGEBALL STARTS TODAY[/offtopicdontrespond]
IMO if you are running a honeypot you throw a very good logger of some sort, a sniffer on a box before the honeypot that is invisible would be ideal, you could tell everything they did with nothing on the pot itself... Firewalls make a honeypot harder to get in to... Which destroys the entire point of the honeypot. Right?
Doesn't work like that. Connections initiated from the outside will be able to get to the server, connections initiated from the inside will get blocked. AFAIK, it's common practice to block all outgoing connections on some webservers. SSH would work incoming, telnet, whatever. But if the attacker used the box to jump to another, they wouldn't be able to make any connections out.Quote:
It wouldn't work if you blocked all outgoing... Think simple ICMP... 3 way handshake.. The sender has to get his response back or he will never know he has any control...
Proof:
http://www.google.com/search?num=100...ll+outgoing%22
First few links.
Errrr, correct me if i am wrong. I think honeypot is a concept. You can use some program to make your linux box looks like running IIS etc (to the hacker) and log down all his activity. So that you can use the log to track him down/ use that as evident. You can also do that with a actual IIS server etc..... The ways are many. But conceptually they are all honeypots.
Your right... I was thinking correctly. I knew that, I just forgot. Damn homework screwed up my brain!Quote:
Originally posted here by Soda_Popinsky
Doesn't work like that. Connections initiated from the outside will be able to get to the server, connections initiated from the inside will get blocked. AFAIK, it's common practice to block all outgoing connections on some webservers. SSH would work incoming, telnet, whatever. But if the attacker used the box to jump to another, they wouldn't be able to make any connections out.
Proof:
http://www.google.com/search?num=100...ll+outgoing%22
First few links.
No, most honeypots are not like that... You almost always use an ACTUAL IIS server as an IIS honeypot...Quote:
Errrr, correct me if i am wrong. I think honeypot is a concept. You can use some program to make your linux box looks like running IIS etc (to the hacker) and log down all his activity. So that you can use the log to track him down/ use that as evident. You can also do that with a actual IIS server etc..... The ways are many. But conceptually they are all honeypots.
No a honeypot is a real bit of kit, not a concept. It is set up for the purpose of investigating internet traffic and hacking activity etc.Quote:
Errrr, correct me if i am wrong. I think honeypot is a concept.
I think you are confusing the difference between a PRODUCTION system and a TEST system. The honeypot is a test system which you usually disguise as a production system to obtain and hold the interest of hackers.
You do not use your honeypot for your daily business, and you do not use your daily business machines as a honeypot :eek:
I think you will understand my point if you consider that a honeypot is a system that is deliberately set up weak and with vulnerabilities in order to provoke attacks, which you then analyse. If you set the honeypot up like your production system then it wouldn't work I SINCERELY HOPE :eek: :D
Hope that helps
You guys are making this much harder than it is. Let's not worry about if it is a concept or if it is an actual program. Look at the name itself, and keep things simple:
Honey pot: A pot of honey used to lure bears into a trap
Absolutely right, Pooh --
A honeypot is a simple concept, but only so much as 'programming' is a simple concept, or 'security' is a simple concept. A honeypot is a tool used to achieve a specific business objective -- draw traffic in so that it can be monitored. And it's definitely not something most people want to truck with unless you are actually a security consultant.
Now wargames, that's just plain fun. My personal recommendation is Hackquest.com, since the challenges are varied and pretty much geared toward the programmer-type.
rijilv:
If you are interested in wargames there is a really good one at
http://www.fallenroot.net
bleh **** the honeynet project and **** honeypots bleh
And if your want a wargame telnet://drill.hackerslab.org
This is a fake wargame, and won't help at all in reality. It relies on you discovering programs that are everyday programs but are also modified from their origonal code. For example, maybe man uses a root call in it, and thus you could exploit that man command since it is running as root even though you are not.Quote:
What in the hell? So they don't want you to actually penetrate the system, they want you to use files and commands they've modified to gain higher and higher access? That's like holding a "who can build a better car" by giving everyone prebuilt parts.
Not to mention that even though you could use the "but it could immiate a rootkit program", it still isn't reality. Have fun playing hide and go seek with hackerslab, but take it's real-world usage with as much confidence as the movie "Hackers".
pooh: actually the game goes in diffrent levels ranging from your silly **** at the start to race conditions bufferoverflows heap overflows and formatstrings there is even a level you need to send a specially crafted packet with the password and user name i think ( its been a while ) and the drill server will send you the pass back and no one says you cant try and break root but last time i checked the only suid root file was a sendmail binary and i cant be assed logging in to the server and running the find command
peace
anybody want to trade....
ill send a gmail invite in exchange for the isp address of the head of the security (malaysia)
plz send me the address asp so that i can use my intelligence network and crack into it right away
thanking you
shahid
Yah Pooh, some wife use that to lure their husband repeat their mistake after they have successfully deliver their first baby.
Pooh drill.hackerslab.org is too tough for me. Is there any starter site for newbie like me?
*^.^*