+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Network Hacking (https://sinister.li/Forum-Network-Hacking)
+--- Thread: Honeypots - A Request (/Thread-Honeypots-A-Request)
Pages:
1
2
RE: Honeypots - A Request - Christ - 06-04-2014
A UML honeypot (which is text-based) is very easy to detect once you've gained access. But bypassing any honeypot is relative to your knowledge of the underlying system (usually unix but sometimes windows). It's not exactly trivial but it's not impossible to bypass jail-shells. For instance, I've gained root on one or two eepsites on i2p, using a method of jail-breaking via bash.
Once you're out of the initial jail-shell, you can basically juss unset it, or pwn the system entirely. The opposite concept was presented at DefCon 15: how to detect and deny web 2.0 attacks using HoneyJax and IDS's/IPS's.
Symantec has a couple articles about defeating web-based honeypots.
http://www.symantec.com/connect/articles/defeating-honeypots-system-issues-part-1
RE: Honeypots - A Request - Eclipse - 06-04-2014
(06-03-2014, 09:26 PM)Christ Wrote: No, s/he is asking for an introduction into honeypots, not criticism.Thank you. (He)
Edit: fixed accidental subjective pronoun assumption.
(06-04-2014, 07:11 AM)Dr.Jekyll and Mr.Hyde Wrote: No, s/he said s/he wanted to
Not text-based bodyguards.
What? o.O
I worded that wrong, I apologize.
(06-04-2014, 10:41 AM)Christ Wrote: A UML honeypot (which is text-based) is very easy to detect once you've gained access. But bypassing any honeypot is relative to your knowledge of the underlying system (usually unix but sometimes windows). It's not exactly trivial but it's not impossible to bypass jail-shells. For instance, I've gained root on one or two eepsites on i2p, using a method of jail-breaking via bash.
Once you're out of the initial jail-shell, you can basically juss unset it, or pwn the system entirely. The opposite concept was presented at DefCon 15: how to detect and deny web 2.0 attacks using HoneyJax and IDS's/IPS's.
Symantec has a couple articles about defeating web-based honeypots.
http://www.symantec.com/connect/articles/defeating-honeypots-system-issues-part-1
Thank you, that was enlightening. I'll be sure to read the entire article.
RE: Honeypots - A Request - Alexaider - 06-14-2014
(05-30-2014, 11:08 PM)Kosaki Wrote: https://sinister.li/Thread-Tutorial-Detecting-Kippo-honeypots?highlight=Detecting%2bKippo
thnks for the link
