TekTip ep11 - Kippo SSH Honeypot

http://code.google.com/p/kippo/

Description: Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker

Uses:  Alert to potiential threats, watch how hackers operate, gather exploits and malware

Installation:

Follow steps @ http://bruteforce.gr/installing-kippo-ssh-honeypot-on-ubuntu.html

http://bruteforce.gr/honeybox Honeybox is a distro that contains numerous honeypot software, all on a single box.  Additionally, the distro preconfigures the honeypot to utilize some of the many enhancements Brutforce Labs have created for these honeypots.

*If at home, to make this accessible from the internet you will need to enable port forwarding at your modem, and potientially your Virtual Machine software.

Usage:

kippo/kippo.cfg : Main configuration file

kippo/honeyfs :  This is the fake filesystem that wll be presented to the user.

kippo/data/userdb.txt :  This file allows us to modify the username and password combinations that will work when attackers attempt to log into the honeypot.

kippo/log/tty/ : In this directory you will find the logs for each session established by attackers.

./start.sh

- will start kippo

/kippo/utils/playlog.py : Replay an attacker session from the kippo/log/tty directory.

Usage: playlog.py [-bfhi] [-m secs] [-w file] <tty-log-file>

 -f             keep trying to read the log until it's closed

 -m <seconds>   maximum delay in seconds, to avoid boredom or fast-forward to the end. (default is 3.0)

-i             show the input stream instead of output

 -b             show both input and output streams

 -c             colorify the output stream based on what streams are being received

 -h             display this help

i.e.

~/kippo/utils/playlog.py 20121012-115031-8544.log

1aN0rmus@tekdefense.com

http://www.securitytube.net/user/1aN0rmus

www.youtube.com/user/TekDefense

TekTip ep10 - Proxychains!

ProxyChains-3.1 (http://proxychains.sf.net)

Proxychains is a tool to force connections through multiple proxies.  What makes this tool special is putting applications without native proxy capabilities through a proxy.

Config: /etc/proxychains.conf

Three main modes

1. Dynamic - All proxies chained in order listed.  Dead proxies are skipped.

2. Strict - All proxies chained in order listed.  If a proxy is dead, the chain is dropped.

3. Random - Randomly chains proxies within the list.

-If using Random, give a chain length to specify how many proxies are used.

Other Important config options:

proxy_dns: ensure this is uncommented if you want to proxy dns requests.  If you don't DNS requests will be handled in the standard manner, unproxied. 

List the proxies use the format of:

"Type address port"

Socks4 127.0.0.1 8888

Usage:

proxychains "application"

proxyxhains curl ifconfig.me

proxychains firefox

proxychains ssh root@8.8.8.8'

proxychains xhydra

1aN0rmus@Tekdefense.com,

securitytube.net/user/1aN0rmus

youtube.com/user/TekDefense