,Cyber Defense Competitions Club Author: Alexander A. Rodriguez-Vargas Disclaimer: This club meeting and presentation is only provided for educational purposes and in no way do we recommend or encourage offensive activity outside of a sandboxed environment. We also own the devices that were used as targets in these scenarios.

Honeypots Decoy servers or systems setup to gather information regarding an attacker or intruder into your system. The Honey Pot system should appear as generic as possible. (example: Microsoft NT based system) You will want to make your Honey Pot an interesting site by placing "Dummy" information. Expect to spend some time making your Honey Pot appear legitimate so that intruders will spend enough time investigating and perusing the system so that you are able to gather as much forensic information as possible. https://www.sans.org/security-resources/idfaq/honeypot3.php

Honeypots http://www.windowsecurity.com/articles-tutorials/windows_os_security/Securing_Windows_2000_DNS_by_design_Part_1.html

Honeypot Selections The ULTIMATE Honeypot Distro: HONEYDRIVE3 Honeyd (very configurable) Kippo-Graph (ssh, collects scripts) Conpot (SCADA) Dionaea (Malware collector) LaBrea Kfsensor (Commercial Windows product) HoneyBot (Windows based) product The ULTIMATE Honeypot Distro: HONEYDRIVE3 https://bruteforce.gr/honeydrive

Kippo Download the ova file from sorceforge and import the VM into VirtualBox http://sourceforge.net/projects/honeydrive/ Boot the VM Follow instructions from the README.txt on the Desktop to start kippo In the command prompt, find your ipaddress Ifconfig Replace the ip address below with honeydrive’s. Browse to https://192.168.1.XXX/kippo-graph/ to view statistics: Top 10 ip addresses Top 10 passwords attempted to login etc

Scans & Attacks Scan the IP to check for open ports etc. nmap –sS –O --reason --max-retires=2 –T4 -sV –Pn –sC 192.168.1.XXX > nmap.txt Unzip your password list gzip –d /usr/share/wordlists/rockyou.txt.gz Bruteforce the ssh password with hydra hydra –v -l root –P /usr/share/wordlists/rockyou.txt 192.168.1.XXX ssh Login to the honeypot with ssh! Ssh root@192.168.1.XXX Then type the password you found through bruteforcing.

Honeypot References http://null-byte.wonderhowto.com/how-to/hack-like-pro-set-up-honeypot-avoid-them-0153391/ https://zeltser.com/modern-honey-network-experiments/ http://www.information-age.com/technology/security/123458520/how-set-cybersecurity-honeypot-your-business https://bruteforce.gr/honeydrive