1. ,Cyber Defense Competitions Club
Author: Alexander A. Rodriguez-Vargas
Disclaimer:
This club meeting and presentation is only provided for educational purposes and in no way do we recommend or encourage offensive activity outside of a sandboxed environment. We also own the devices that were used as targets in these scenarios.

2. Honeypots
Decoy servers or systems setup to gather information regarding an attacker or intruder into your system.
The Honey Pot system should appear as generic as possible.
(example: Microsoft NT based system)
You will want to make your Honey Pot an interesting site by placing "Dummy" information.
Expect to spend some time making your Honey Pot appear legitimate so that intruders will spend enough time investigating and perusing the system so that you are able to gather as much forensic information as possible.

3. Honeypots

4. Honeypot Selections The ULTIMATE Honeypot Distro: HONEYDRIVE3
Honeyd (very configurable)
Kippo-Graph (ssh, collects scripts)
Conpot (SCADA)
Dionaea (Malware collector)
LaBrea
Kfsensor (Commercial Windows product)
HoneyBot (Windows based) product
The ULTIMATE Honeypot Distro: HONEYDRIVE3

5. Kippo
Download the ova file from sorceforge and import the VM into VirtualBox
Boot the VM
Follow instructions from the README.txt on the Desktop to start kippo
In the command prompt, find your ipaddress
Ifconfig
Replace the ip address below with honeydrive’s.
Browse to to view statistics:
Top 10 ip addresses
Top 10 passwords attempted to login
etc

6. Scans & Attacks Scan the IP to check for open ports etc.
nmap –sS –O --reason --max-retires=2 –T4 -sV –Pn –sC XXX > nmap.txt
Unzip your password list
gzip –d /usr/share/wordlists/rockyou.txt.gz
Bruteforce the ssh password with hydra
hydra –v -l root –P /usr/share/wordlists/rockyou.txt XXX ssh
Login to the honeypot with ssh!
Ssh
Then type the password you found through bruteforcing.

7. Honeypot References