4 ms·

I want to give this a try. Years ago I stumbled upon a similar project written in python which I don't remember the name of, but something about its handshake m

I want to give this a try. Years ago I stumbled upon a similar project written in python which I don't remember the name of, but something about its handshake must have been fishy as most clients disconnected again right away without trying to authenticate. (The initial version string sent by the server looked fine but I wasn't motivated enough to dig any further.)

spydum 7y ago
You might be thinking of kippo? Honeypots are fun to think about and toy with - I just never have any idea what to do with the logs and data?
- mnky9800n 7y ago
  Write a report or paper or blog or something about it I guess.
- achillean 7y ago
  The major use case for them nowadays is to help filter out the noise in your alerts. See for example a company such as GreyNoise (https://www.greynoise.io https://www.greynoise.io) to help companies focus on real attacks and not just background noise/ automated attacks.
  - yjftsjthsd-h 7y ago
    Alternatively, run on your internal network and alert on every attempt....
- iforgotpassword 7y ago
  Yes that's the one! Toying around was exactly my plan. See if any interesting sessions show up. I have a couple ideas like trying to automatically group or classify them but there are way too many things on my "would be cool to try" todo list already..
- bediger4000 7y ago
  I believe kippo is the ancestor of Cowrie.
tastroder 7y ago
That's likely an artifact of the client side I'd think. While not most of them, a significant portion of clients exhibited similar behaviour on mine. Disconnects before the handshake were quite common (due to simple port scanning), others seemed to perform the handshake for discovery without actually completing/attempting a login. I've chalked that up to things looking for vulnerable server versions (e.g. home routers). About the only interesting thing I've seen on mine was login attempts using a single compromised key instead of the old brigade of admin/admin password attempts. Although I guess that might just be some known backdoor of some popular network equipment that I was not aware of at the time.

spydum 7y ago

You might be thinking of kippo? Honeypots are fun to think about and toy with - I just never have any idea what to do with the logs and data?

mnky9800n 7y ago
Write a report or paper or blog or something about it I guess.
achillean 7y ago
The major use case for them nowadays is to help filter out the noise in your alerts. See for example a company such as GreyNoise (https://www.greynoise.io https://www.greynoise.io) to help companies focus on real attacks and not just background noise/ automated attacks.
- yjftsjthsd-h 7y ago
  Alternatively, run on your internal network and alert on every attempt....
iforgotpassword 7y ago
Yes that's the one! Toying around was exactly my plan. See if any interesting sessions show up. I have a couple ideas like trying to automatically group or classify them but there are way too many things on my "would be cool to try" todo list already..
bediger4000 7y ago
I believe kippo is the ancestor of Cowrie.

tastroder 7y ago

That's likely an artifact of the client side I'd think. While not most of them, a significant portion of clients exhibited similar behaviour on mine. Disconnects before the handshake were quite common (due to simple port scanning), others seemed to perform the handshake for discovery without actually completing/attempting a login. I've chalked that up to things looking for vulnerable server versions (e.g. home routers). About the only interesting thing I've seen on mine was login attempts using a single compromised key instead of the old brigade of admin/admin password attempts. Although I guess that might just be some known backdoor of some popular network equipment that I was not aware of at the time.