4 ms·

I do red team, if I see a server with 20+ ports I'll immediately assume it's a honeypot and will stop scanning it. If you are part of a blue team you WANT them

I do red team, if I see a server with 20+ ports I'll immediately assume it's a honeypot and will stop scanning it. If you are part of a blue team you WANT them to waste time, not instantly know it's a honeypot, that's what I meant for specifically this software.

cafeinux 2y ago
So what you're saying is that I should open 30 ports on my critical servers so that they are ignored as honeypots by the attackers? Noted.
- AbraKdabra 2y ago
  I mean sure, absolutely go for it, don't forget to tell me the IP so I can add it to my ignore list.
  - dylan604 2y ago
    If you’re a red team member that needs to be told this type of information, you’re not very good at it. You just said this is something you do on your own, so why would you need to be told about it? Either you do it or you don’t.
    - AbraKdabra 2y ago
      youdidntgetthejoke.jpg
    - deleted 2y ago
      [deleted]
  - cafeinux 2y ago
    Sure, here you are! 127.0.0.1 Thank you for your thoughtfulness.
dylan604 2y ago
I remember the first box I ever built that went online before I had any clue about what I was doing. It had to have looked like a honeypot. Then someone knowledgeable helped me and started shutting things down. They also mentioned Debian being designed as essentially opt-in instead of opt-out to precisely avoid this issue
- AbraKdabra 2y ago
  Exactly, most people confuse the fact that a server being a honeypot doesn't mean "HEY SCAN ME HEY I'M A HONEYPOT SCAN ME SO I CAN GET FREE INFO", you need a balance between exposing yourself and being authentic so the person on the other side doesn't tap Ctrl-C at the sight of a lot of ports opened. I'm mean sure, you'll get a ton of info from bots, but if you're truly using a honeypot for R&D you want the true hackers to knock on your door.
remram 2y ago
I think what's neat is that this tool can reply to so many protocols/ports, you can enable whichever subset you want. You could also easily tweak it to have the ports spread on a few different IP addresses instead of a single one. That would make them much less obvious.
pixl97 2y ago
Then you're missing out on juicy stuff... I work with a number of overseas clients where getting extra IPv4 is nearly impossible. I'll see them setup a ip forwarding box to tons of different applications. That application may have its own reverse proxy serving even more stuff. The real world has some scary things in it.

cafeinux 2y ago

So what you're saying is that I should open 30 ports on my critical servers so that they are ignored as honeypots by the attackers? Noted.

AbraKdabra 2y ago
I mean sure, absolutely go for it, don't forget to tell me the IP so I can add it to my ignore list.
- dylan604 2y ago
  If you’re a red team member that needs to be told this type of information, you’re not very good at it. You just said this is something you do on your own, so why would you need to be told about it? Either you do it or you don’t.
  - AbraKdabra 2y ago
    youdidntgetthejoke.jpg
  - deleted 2y ago
    [deleted]
- cafeinux 2y ago
  Sure, here you are! 127.0.0.1 Thank you for your thoughtfulness.

dylan604 2y ago

I remember the first box I ever built that went online before I had any clue about what I was doing. It had to have looked like a honeypot. Then someone knowledgeable helped me and started shutting things down. They also mentioned Debian being designed as essentially opt-in instead of opt-out to precisely avoid this issue

AbraKdabra 2y ago
Exactly, most people confuse the fact that a server being a honeypot doesn't mean "HEY SCAN ME HEY I'M A HONEYPOT SCAN ME SO I CAN GET FREE INFO", you need a balance between exposing yourself and being authentic so the person on the other side doesn't tap Ctrl-C at the sight of a lot of ports opened. I'm mean sure, you'll get a ton of info from bots, but if you're truly using a honeypot for R&D you want the true hackers to knock on your door.

remram 2y ago

I think what's neat is that this tool can reply to so many protocols/ports, you can enable whichever subset you want. You could also easily tweak it to have the ports spread on a few different IP addresses instead of a single one. That would make them much less obvious.

pixl97 2y ago

Then you're missing out on juicy stuff... I work with a number of overseas clients where getting extra IPv4 is nearly impossible. I'll see them setup a ip forwarding box to tons of different applications. That application may have its own reverse proxy serving even more stuff. The real world has some scary things in it.