4 ms·
My experience with kippo was that it basically didn’t work. They’d come in and run a few commands and then ghost. I figured they had some easy way to find out i
by 3fe9a03ccd14ca5 7y ago
My experience with kippo was that it basically didn’t work. They’d come in and run a few commands and then ghost. I figured they had some easy way to find out if they were inside a honeypot that’s was immediately obvious to me.
- mike_d 7y agoYup, Kippo is extremely easy to detect. Full interaction honeypots based on NAT like this are also detectable if you look at RTT and TTL on packets pre-auth and post-auth.
- frequentnapper 7y agoin this case: check if a directory /home/honssh exists to detect that it's a honeypot?
- robputt796 7y agoI think this would not work because the HonSSH server with the HonSSH user is hosting a proxy service. The user gets dumped into an actual vanilla looking Linux host at the backend.