4 ms·
So, at my work, we host both SFTP and FTP to receive data feeds. Has anyone seen an FTP honeypot that would serve zip bombs to malicious users and allow legit
by dillonmckay 7y ago
So, at my work, we host both SFTP and FTP to receive data feeds.
Has anyone seen an FTP honeypot that would serve zip bombs to malicious users and allow legit users proper access?
- nolok 7y agoI've always imagined the risk of someone doing that on purpose to something they then post on /r/opendirectories Most of those people seem to grab and open those files without any security measures, docx, pdf, archives, often .exe
- jay_wild 7y agoCowrie [0] provides an SFTP and Telnet honeypot and you can configure the filesystem to serve your desired files. Not quite a passthrough for legitimate use, unfortunately [0]: https://github.com/cowrie/cowrie https://github.com/cowrie/cowrie
- SteveNuts 7y agoI always worry that if I do something like this it'll cause the malicious person to spend extra effort and attention on a real attack. Because that's what I'd do if I hit a honeypot...
- dillonmckay 7y agoFair point.