• To record the usernames and password which the attacker is trying to perform a brute-force attack.
  
• To create a valid username/password like "root/root" to offer the attacker a fake filesystem (resembling a Debian 5.0) with the ability to add or remove files and save the command executed by the attacker.
  
• To save suspicious files downloaded (via wget) by the attacker.
  
• Possibility of adding a /etc/passwd file so the attacker can 'cat' it.
  

1. Raspberry-PI
   
2. Kali Linux
   
3. Kippo installation
   

Quote:sudo fdisk -l

Quote:sudo dd if=kali-linux-2.0-armel-rpi.img of=/dev/sdb bs=512k
(check your image name it might be different so make necessary changes.)

Quote:sudo apt-get install subversion python-twisted python-mysqldb apache2

Quote:root@kali:/# apt-get install mysql-server
root@kali:/# apt-get install mysql-client

Quote:root@kali:/# mysql -h localhost -u root -p
mysql> create database kippo;
mysql> GRANT ALL ON kippo.* TO 'kippo'@localhost IDENTIFIED BY 'Kippo-password';
exit

Quote:root@kali:/# cd /usr/local/src/kippo-0.8/doc/sql/
mysql> mysql -u kippo -p
mysql> use kippo;
mysql> source mysql.sql;
mysql> show tables;
exit

Quote:[database_mysql]
host = localhost
database = kippo
username = kippo
password = Kippo-password

Quote:root@kali: useradd -d /home/kippo -s /bin/bash -m kippo -g sudo
root@kali:/usr/local/src# chown -R kippo kippo-0.8/

Quote:sudo apt-get update
sudo apt-get install libapache2-mod-php5 php5-cli php5-common php5-cgi php5-mysql php5-gd

Quote:root@kali:/# wget http://bruteforce.gr/wp-content/uploads/kippo-graph-0.8.tar
root@kali:/# mv kippo-graph-0.8.tar /var/www/
root@kali:/var/www# tar xvf kippo-graph-0.8.tar --no-same-permissions
chmod 777 generated-graphs
vim config.php #enter the appropriate values
sudo /etc/init.d/apache2 restart

Quote:root@kali:/usr/local/src/kippo-0.8# su kippo
kippo@kali:/usr/local/src/kippo-0.8# ./start.sh

• Top 10 passwords
  
• Top 10 usernames
  
• Top 10 user-pass combos
  
• Success ratio
  
• Successes per day/week
  
• Connections per IP for previous month
  
• Successful logins from the same IP
  
• Probes per day/week
  
• Top 10 SSH clients
  
• Human activity inside the honeypot
  
• Top 10 input (overall)
  
• Top 10 successful input
  
• Top 10 failed input
  
• passwd commands
  
• wget commands
  
• Executed scripts
  
• Interesting commands
  
• apt-get commands
  
• Top 10 IP addresses probing the system for previous month
  
• Total IP addresses probing the system per top 10 countries
  

Here are some example images:

(04-27-2016, 05:19 PM)insidious15 Wrote: This is pretty cool. If i still ran a dynamic site with a server that used PHP rather than a static HTML/CSS site, I would probably implement something like this to get back at those attackers

nice job though. Thanks for sharing.

(04-30-2016, 12:51 PM)haccur Wrote: Very nice guide but here is my "tips" of this guide:
Don't use Kippo is old and when the attacker try to login it to access to the shell is like 35/40 seconds for access to it so maybe the bruteforce script they using detect the shell as pinged out so you don't can collect anything of the attacker only failed logins use Cowrie instead here's the link
Use the ultimate version of kippo-graph i don't try it with cowrie but i think is working well since cowrie is a fork of kippo
Change the SSH banner to something "new" a box running debian 5.0 on 2016 is suspicious as hell so maybe the attacker skip that boxes since is kippo default banner
Kali Linux is not necessary at all just use raspbian lite of other distro you like

(05-06-2016, 10:00 PM)Pirate Wrote: We need more HQ tutorials like this.
Thank's for your contribution sir.