4 ms·

I front all my honeypots with the IIS landing page precisely because it attracts black hat jagoffs. Nothing makes me happier than knowing I've wasted hours of

I front all my honeypots with the IIS landing page precisely because it attracts black hat jagoffs. Nothing makes me happier than knowing I've wasted hours of their time chasing their own tails.

themafia 4mo ago
Noise is a really underrated security layer.
- YeahThisIsMe 4mo ago
  That's just security by obscurity, which is rated pretty appropriately.
  - close04 4mo ago
    Obscurity is a perfectly adequate layer of security. It shouldn't be the only layer but those who argue against adding it heard at some point "security through obscurity is not security" and never dug deeper.
    - seethishat 4mo ago
      I agree. Hiding from a grizzly bear is a good strategy. But if that fails, you will need pepper spray and maybe a shotgun. Bear Defense Plan: Hide, Non-lethal, Lethal.
      - Alphanymous 4mo ago
        You've said it just like it is, prevention + preparation.
    - loneboat 4mo ago
      ... those who argue against adding it heard at some point "security through obscurity is not security" and never dug deeper. Ironically, that makes them the exact type of person who would be successfully deterred by a layer of obscurity.
- l23k4 4mo ago
  [dead]
p1necone 4mo ago
Why stop there? Front the honeypot with a real IIS server, build a matryoshka doll of honeypots and see how far people get.
wil421 4mo ago
Tell me more…I opened a plex and Nintendo switch port, the scans were out of control. I’d love to screw over port scanner over.
- fragmede 4mo ago
  What does shodan.io run?
  - wil421 4mo ago
    Not sure but the IPs don’t come back as Chinese and the dns registries, domains, and other data I could find was generated using US address data. Lots of stuff like 123 stree, where half the address was truncated.
DaSHacka 4mo ago
Unless you're honeypotting in the IP range of an established organization, all you're doing is getting bot traffic. High-tier blackhats focus on big targets, and low-tier ones focus on low-hanging fruits they find off shodan or application 0days they've found.
- bitwize 4mo ago
  "Guys, guys, guys, listen, listen, listen. So I'm in this computer, right? So I'm lookin' around, lookin' around, throwing commands at it, I don't know where it is or what it does or anything..."
  - forgetfreeman 4mo ago
    Some ATM in bumsville Idaho spit $700 into the middle of the street.
  - wildlogic 4mo ago
    joey, is that you!?
  - stavros 4mo ago
    Where's that from?
    - bryanrasmussen 4mo ago
      I think it's from hackers, Joey the youngest hacker found the bad guys computers, not sure if it's an accurate quote since it's been years since I saw it.
      - egil 4mo ago
        "They're trashing! They're trashing our rights!"
        giancarlostoro 4mo ago
raverbashing 4mo ago
Sounds like creating an url like aspnet_client/admin.php returning a WebObjects header might be a good hobby
- kreyenborgi 4mo ago
  Add in a zip bomb or two?
  - MrDrMcCoy 4mo ago
    Now you have me wondering how badly http gzip content compression can be abused along those lines.

I front all my honeypots with the IIS landing page precisely because it attracts black hat jagoffs. Nothing makes me happier than knowing I've wasted hours of their time chasing their own tails.

themafia 4mo ago

Noise is a really underrated security layer.

YeahThisIsMe 4mo ago
That's just security by obscurity, which is rated pretty appropriately.
- close04 4mo ago
  Obscurity is a perfectly adequate layer of security. It shouldn't be the only layer but those who argue against adding it heard at some point "security through obscurity is not security" and never dug deeper.
  - seethishat 4mo ago
    I agree. Hiding from a grizzly bear is a good strategy. But if that fails, you will need pepper spray and maybe a shotgun. Bear Defense Plan: Hide, Non-lethal, Lethal.
    - Alphanymous 4mo ago
      You've said it just like it is, prevention + preparation.
  - loneboat 4mo ago
    ... those who argue against adding it heard at some point "security through obscurity is not security" and never dug deeper. Ironically, that makes them the exact type of person who would be successfully deterred by a layer of obscurity.
l23k4 4mo ago
[dead]

p1necone 4mo ago

Why stop there? Front the honeypot with a real IIS server, build a matryoshka doll of honeypots and see how far people get.

wil421 4mo ago

Tell me more…I opened a plex and Nintendo switch port, the scans were out of control. I’d love to screw over port scanner over.

fragmede 4mo ago
What does shodan.io run?
- wil421 4mo ago
  Not sure but the IPs don’t come back as Chinese and the dns registries, domains, and other data I could find was generated using US address data. Lots of stuff like 123 stree, where half the address was truncated.

DaSHacka 4mo ago

Unless you're honeypotting in the IP range of an established organization, all you're doing is getting bot traffic. High-tier blackhats focus on big targets, and low-tier ones focus on low-hanging fruits they find off shodan or application 0days they've found.

bitwize 4mo ago
"Guys, guys, guys, listen, listen, listen. So I'm in this computer, right? So I'm lookin' around, lookin' around, throwing commands at it, I don't know where it is or what it does or anything..."
- forgetfreeman 4mo ago
  Some ATM in bumsville Idaho spit $700 into the middle of the street.
- wildlogic 4mo ago
  joey, is that you!?
- stavros 4mo ago
  Where's that from?
  - bryanrasmussen 4mo ago
    I think it's from hackers, Joey the youngest hacker found the bad guys computers, not sure if it's an accurate quote since it's been years since I saw it.
    - egil 4mo ago
      "They're trashing! They're trashing our rights!"
      - giancarlostoro 4mo ago

raverbashing 4mo ago

Sounds like creating an url like aspnet_client/admin.php returning a WebObjects header might be a good hobby

kreyenborgi 4mo ago
Add in a zip bomb or two?
- MrDrMcCoy 4mo ago
  Now you have me wondering how badly http gzip content compression can be abused along those lines.