Hack Like a Pro: How to Set Up a Honeypot & How to Avoid Them « Null Byte :: WonderHowTo

Welcome back, my aspiring hackers!Those of you who've been readingmy tutorialsfor some time now know that I am adamant regarding the necessity of learning andusing Linuxto hack. There is no substitute, period.In this tutorial, though, we will be setting up a system to attract hackers so we can catch or study them. Since nearly all of the hackers around the world are targeting Windows servers forall of their known flaws and vulnerabilities, we will be setting up a Windows system to do just that.A honeypot is a computer system that looks enticing to a hacker. It looks important and vulnerable, enough that the hacker attempts to break in. It is used to entrap hackers and as a way to study the techniques of hackers by the security community. As a hacker, it is important to know that these exist and the risks one bears if you get entrapped in one.Here, we will be setting up a honeypot. If you leave it up and running, you can observe others hackers practicing their art. In addition, we will do somereconon the honeypot to see what it looks like from the attacker's perspective.It's important to the hacker to know what these honeypots look like from the outside in order to avoid them and avoid a long prison sentence of hard labor and living on gruel three times a day.Step 1: Install KFSensorThere are a number of honeypots on the market including honeynet, honeyd, Tiny Honeypot, NetBait, and ManTrap, but we will be using a commercial honeypot,KFSensor, for Windows.KFSensor will enable us to have an authentic Windows system hosting it and we can use ourKali Linux systemto do recon on it. One of the things we want to accomplish in this tutorial is to identify ways to detect a honeypot and then run far, far away.Let's open a browser and navigate towww.kfsensor.com, then download and install the software. It's a 30-day trial, so we have a month to play with it for free.Once it is installed, right-click on the KFSensor icon and "run as administrator". You should get a set up wizard like this.After going through a few more screens in the wizard choosing the defaults, you come to the screen below that allows you to choose the native services. Let's choose all of them.Then, choose your domain name. You might want to make it sound enticing. The default isnetworksforu.com, but I made minefirstfinanacial.comhoping to make the hacker think it's a financial website.Next, you can choose an email address where you want to send the alerts.Step 2: Choose OptionsFinally, we have a few options to choose. Let's go with the defaults, but note the final option. Here it allows us to capture the packets so that we can analyze the attacks with a tool likeWiresharkor other protocol analyzer. It warns you, though, that packet captures can take up a lot of disk space; if you're trying to catch or study a hacker, it's necessary. We'll leave it disabled for now.Step 3: Set Up Your Honeypot and WatchWhen you have completed the wizard, clickFinishand you should have an application that looks like this.Step 4: Sacn with NmapNow that we have our honeypot setup, let's take the approach of the hacker. Just as if we were doing recon on a potential target, let'suse nmap to scan that system. Let's do a SYN scan:nmap -sS 192.168.1.102As you can see, we find numerous ports open. As a hacker, this is a big RED FLAG. Few commercial web servers would leave all these ports open. Not in 2014!If we go back to the honeypot, we can see that we set off an alert for a port scan in the purple highlighted area. Remember that a SYN scan does not complete a 3-way handshake, but mostintrusion detection systemsconsider many packets coming in rapid succession from one IP to be a "possible port scan". This is one reason why it is often advisable to slow your scan down with nmap's built-in speed controls.Step 5: Scan with NiktoIn an earlier guide, I showed youhow to use nikto to find vulnerabilities in web servers. Let's use it here against this honeypot../nikto.pl -h 192.168.1.102Our results tell us that this system is a default install of Microsoft's IIS 7 server. Another RED FLAG that this might be a honeypot.Step 6: Banner GrabLastly, let's try a banner grab. We canconnect with netcatto port 80 and then try to grab the web server banner, if there is one.nc 192.168.1.102 80HEAD / HTTP/1.0As you can see, we were able to grab the banner identifying the web server as Microsoft's IIS 7.5.Some Telltale Signs of a HoneypotThere is NO single telltale sign of a honeypot, but there are few things to keep in mind.The age-old adage, "if it is too good to be true, it probably is", applies as well to hacking. Those sites that seem extraordinarily easy to hack are likely traps.Look for unusual services and ports open. Most internet-facing systems are stripped of any unnecessary services. If it has lot of unusual services and ports open, these are meant to attract attackers and it may be a honeypot.If it is a default install, it may be a honeypot.If there is little or no activity, it may be a honeypot.If you see directories with names such a "social security numbers" or "credit card numbers", it may be a honeypot.If you see very little software installed, it may be a honeypot.If there is a lot of free space on the hard drive, it may be a honeypot.Be careful out there, my aspiring hackers, as I want to to keep coming back toNull Byteto refine your skills, rather than sitting in a concrete room. Keep in mind that honeypots are meant to be enticing, but it may be a trap!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseOriginal honeypotimage via Cokeisit7/Flickr,Green codeimage via ShutterstockRelatedHack Like a Pro:Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 1How To:Use the Cowrie SSH Honeypot to Catch Attackers on Your NetworkHow To:Block Annoying GDPR Cookie Pop-Ups While Browsing the Web on AndroidHack Like a Pro:Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 2 (Configuration)How To:Calculate Shipping Costs with UPSNews:You Can Get a OnePlus 7 Pro with INSANE Specs for the Price of theXRor S10eHow To:Color code your Christmas gifts to avoid destination mix-upsHow To:Block Pop-Up in Firefox, Chrome and Internet ExplorerHow To:Build your own slider camera dollyHow To:Shoot in 4K with the Selfie Camera on Your iPhone 11, 11 Pro & 11 Pro MaxHow To:Target your triceps when doing push-ups or press-upsNews:Google Assistant's 'April Foolproof' Command Will Help You Avoid Getting PrankedHow To:Make your UPS battery last a long timeHow To:Watch This Sunday's 2013 Pro Bowl Football Game OnlineHow To:Track a Package with UPSHow To:Hack a UPS with a car batteryHow to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksHow To:Pick pockets like a proApple Maps 101:How to Avoid Highways During Driving DirectionsHow To:Ship Internationally with UPSHow To:Use the Power option on Windows 7 to maximize Pro toolsHow To:Hack a Self-Timer into Instagram & Vine for No-Touch Video Recording on a Samsung Galaxy Note 2How To:Improve Cash Flow with the UPS Billing CenterHow To:Generate Viral Memes Like a Pro with These Apps for Your iPhoneHow To:Do push-ups on a Pilates Reformer exercise machineHow To:Perform Quick Actions with Custom Status Bar GesturesNews:WATCH THIS INSTEAD - Grown UpsNews:Grown UpsFirst Round:What really grinds my gears.How To:Burn an XDG3 Formatted Xbox 360 Game ISO with WindowsCamera Plus Pro:The iPhone Camera App That Does it AllHow To:The Official Google+ Insider's Guide IndexThe Film Lab:Chroma Keying in Final Cut ProNews:Vamos Começar