Kippo 101
0 likes470 views
The document discusses Kippo, a low-interaction honeypot that emulates SSH services. It describes what a honeypot is, types of honeypots including high and low interaction, and examples of lower interaction honeypots like Kippo. It provides instructions for getting Kippo, configuring its database and configuration file, and redirecting SSH traffic to Kippo's emulated SSH service using iptables. The document aims to demonstrate how to run Kippo as a honeypot.
![Configuring Kippo
Basic Configuration File: kippo.cfg
ssh_port = 2222
iptables –A PREROUTING –t nat –i eth0 –p tcp
--dport 22 –j REDIRECT --to-port 2222
[database_mysql]
log – log files
dl – downloaded files
honeyfs – virtual file contents
txtcmds – Commands that output text](https://image.slidesharecdn.com/kippo101slideshare-140611211027-phpapp02/85/Kippo-101-8-320.jpg)
Kippo 101
- 1. EmilTan Team Lead, Co-Founder http://edgis-security.org @EdgisSecurity Research Guide http://honeynet.sg Kippo 101
- 2. What is honeypot? Information system resources which have no production values. Its values lies in unauthorised or illicit use of the resource. Its value lies in being probed, attacked, or compromised. -- Spitzner KnowYour Enemy.
- 3. Types of Honeypots. High Interactions –Actual Machine. Low Interactions –A program. Honeytokens. Hybrid.
- 4. Lower Interaction Honeypots Honeyd Tiny Honeypot Dionaea Glastopf Ghost USB Honeyports Conpot Thug Kippo
- 6. Getting the Codes Dependencies subversion python-twisted mysql-server python-mysqldb mysql-server http://kippo.googlecode.com/svn/trunk/
- 7. Kippo’s Database Tables auth clients downloads input sensors sessions ttyplog
- 8. Configuring Kippo Basic Configuration File: kippo.cfg ssh_port = 2222 iptables –A PREROUTING –t nat –i eth0 –p tcp --dport 22 –j REDIRECT --to-port 2222 [database_mysql] log – log files dl – downloaded files honeyfs – virtual file contents txtcmds – Commands that output text
- 9. Run Kippo! Demonstration SpecialThanks to @lvdeijk for Sharing Some RecordedTTYs.