Learn from your attackers with a high interactivity SSH Honey Pot
1–10 of 21 posts
Re: Learn from your attackers with a high interactivity SSH Honey Pot
#2Was halfway expecting a GPT-2 model trained to act like a bash shell.
Re: Learn from your attackers with a high interactivity SSH Honey Pot
#3Hug of death? Try: https://web.archive.org/web/20200104032004/https://www.rober...
Re: Learn from your attackers with a high interactivity SSH Honey Pot
#4good linking @cmroanirgo
Re: Learn from your attackers with a high interactivity SSH Honey Pot
#5[deleted]
Re: Learn from your attackers with a high interactivity SSH Honey Pot
#6Was halfway expecting a GPT-2 model trained to act like a bash shell.
What an extremely fun idea.
Re: Learn from your attackers with a high interactivity SSH Honey Pot
#7My experience with kippo was that it basically didn’t work. They’d come in and run a few commands and then ghost. I figured they had some easy way to find out if they were inside a honeypot that’s was immediately obvious to me.
Re: Learn from your attackers with a high interactivity SSH Honey Pot
#8Error establishing a database connection
Re: Learn from your attackers with a high interactivity SSH Honey Pot
#9My experience with kippo was that it basically didn’t work. They’d come in and run a few commands and then ghost. I figured they had some easy way to find out if they were inside a honeypot that’s was immediately obvious to me.
Yup, Kippo is extremely easy to detect.
Full interaction honeypots based on NAT like this are also detectable if you look at RTT and TTL on packets pre-auth and post-auth.
Re: Learn from your attackers with a high interactivity SSH Honey Pot
#10My experience with kippo was that it basically didn’t work. They’d come in and run a few commands and then ghost. I figured they had some easy way to find out if they were inside a honeypot that’s was immediately obvious to me.
in this case: check if a directory /home/honssh exists to detect that it's a honeypot?