- [Instructor] In this segment, we're gonna take
a look at a very simple honeypot.
Now, just as a refresher, there are two types of honeypots:
high interaction honeypots, which are live systems,
and low interaction honeypots that imitate services
that frequently attract attacker attention,
such as FTP, HTTP, and Telnet.
Now, we're going to use
an applet called BackOfficer Friendly
to configure a low interaction honeypot,
and we're gonna configure BackOfficer Friendly
to imitate FTP, Telnet, and HTTP services,
as well as fake replies.
But before we do that, I wanna prove
to you that I'm actually not running those services
on this workstation.
So, I'm gonna use Angry IP Scanner,
and I'm just gonna do a quick port scan.
And I've configured the port scan only
to look for ports one through 100.
And that's because the ports that we're actually
going to be imitating ports 21, 23, and 80.
So if they were open, they would show in this scan.
Our scan is complete.
I did a port scan on the local host, and you can see
where it says ports in that range.
It's gonna be one to 100, not available.
Now I'm gonna come back up to BackOfficer Friendly,
and I'm gonna say,
Listen for FTP. (computer chiming)
I'm going to say
Listen for HTTP, (computer chiming)
and Listen for Telnet. (computer chiming)
I'm also gonna say fake some replies.
So now, BackOfficer Friendly is
a low interaction honeypot that is seeming
to be available and listening
on ports 21, 23, and 80.
So, let's go ahead and re-scan the range.
(computer chiming) And if you look up
at the warning from BackOfficer Friendly,
the warning screen, (computer chiming)
what you'll see is it just got a request
for an FTP connection, a Telenet connection,
and an HTPP request connection.
And if I come down to my port scanner, it now appears
that ports 21, 23, and 80 are all active.
That means they're listening
for FTP, Telnet, and HTTP requests.
Let me show this to you another way.
I'm gonna come over to my command prompt,
and I'm going to launch an FTP session.
I'm gonna say open 192.168.0.191.
(computer chiming)
It tells me that I'm connected,
but then tells me that service is unavailable,
and the connection was closed by the remote host.
And if you look in the BackOfficer Friendly warning screen,
you'll see that there was
an FTP connection from 192.168.0.191
Now, the connection closed by remote host was a fake reply.
If I come back to my options, and I turn off fake reply,
and I do this again.
I'm gonna
open 192.168.0.191,
(computer chiming) And this time,
I'm gonna get the connection
to 191.600.191, connection closed by remote host.
So I get a different message.
The top message was because I had fake replies.
The bottom was because I don't have fake replies enabled.
Honeypots are a deception technique
that allows security defenders to predict
and understand attacker behavior patterns.
Now, honeypots vary based on design and deployment models,
but what they all have in common is
that they're intended to look legitimate
to attract attackers.
And that, my friends, is a closer look.