[Ex094]

Intro

Hello HC!
Today the topic of my tutorial is Creating a Honeypot on Linux but before we continue we need to understand what the term "Honeypot" stands for:

Code:

In easy words, Honeypot is a fake system which is used to set a trap for intruders trying to gain unauthorized access to your system. A Honeypot is like a virtual program which tends to be a part of the computer and the network on which it is installed. A Honeypot detects scans, bruteforce attempts, nmap service scans, pings, telnet connections and more!

Usually Honeypot are of three types:

Code:

1) Pure Honeypot 2) High Interaction Honeypot 3) Low interaction Honeypot

For this tutorial we going to take a look at only Low Interaction Honeypot, this type of Honeypot deploys services that are frequent targets for hackers. This type of honeypot has code, and can be installed on a physical system, This honeypot is not complex either.

There are many Honeypot Programs but the one we are going to install is called "Artillery". It's developed by the same team who have made SET (Social Engineering Toolkit )

Installing Artillery

First of all open a Terminal and type the following command as root:

Code:

sudo git clone https://github.com/trustedsec/artillery/ artillery/

Then Navigate to the folder "artillery" by typing:

Code:

cd artillery

It has a setup.py script read y to be executed so type:

Code:

sudo python setup.py

Follow the on screen instructions from the CLI and complete the installation

Configuring Artillery

Artillery has a configuration file which lets you edit it's configurations easily, For that in the same terminal as before type:

Code:

sudo gedit config

Now the Text Editor will open your Config file, Make sure the following things are set correctly:

Code:

# DO YOU WANT TO TURN ON THE HONEYPOT HONEYPOT=YES # DO YOU WANT TO AUTOMATICALLY BAN ON THE HONEYPOT HONEYPOT_BAN=YES # PORTS TO SPAWN HONEYPOT FOR PORTS="135,445,22,1433,3389,8080,21,5900,25,53,110,1723,1337,10000,5800,44443" # DO YOU WANT TO MONITOR SSH BRUTE FORCE ATTEMPTS SSH_BRUTE_MONITOR=ON # HOW MANY ATTEMPTS BEFORE YOU BAN SSH_BRUTE_ATTEMPTS=4

Once you have done editing, Type the following code in the same terminal:

Code:

sudo python restart_server.py

Operational Check

To see if Artillery is operating correctly, type the following netstat command in your terminal:

Code:

netstat -antp

You should see the following:



What are these?

These are actually the dummy ports setup by artillery to see if someone connects to it, scans on them etc. If it detects suspicious activity it blocks the IP permanently.

Working Test

To test Artillery, From another PC. run the following command:

Code:

telnet your_artillery_pc_IP artillery_dummy_port

e.g:

Code:

telnet 192.168.0.120 445

Next time you connect, You'll get a connection error. I'll be posting some more testing stuff later

Congratulations, You’ve setup a small low-interaction Honeypot on your system
Tutorial by Ex094

[Snipa]

Easy to follow

Very well explained

Keep it up !

[MrGeek]

Nice explain bro
I myself went into a honey pot ... a month ago when I tried to SQL inject a gov server

[The Real Slim Shady]

Noob beware: setting up a honeypot can be fun, interesting, and a valuable experience... but a wrong configuration and the next thing you know you have provided a hacker with a platform to launch further attacks into your network, or someone elses. Not familiar with this specific software first hand, but as a general rule... focus and monitor your honeypot. dont leave it unattended for long periods!

[diana32]

Well -what should i say - i install and run on my backtrack- i never here before about this and i give a thanks and a reputation point

[Ex094]

Thanks for all your replies, Glad you guys liked it

[RogueCoder]

Thanks for another great read mate

[soh_cah_toa]

I've been meaning to setup a honeypot for a while so I'm genuinely interested in this. I got Artillery up and running on a VM super quick and it does it's job well. Deploying this would actually make a nice weekend project.

I love the Hackers reference when exiting the program. Silly ReL1K...

[0wi5py]

Very Nice :Smile:
Keep it up. :Smile: