Glastopf

Glastopf is a Python web application honeypot founded by Lukas Rist.

General approach:

• Vulnerability type emulation instead of vulnerability emulation. Once a vulnerability type is emulated, Glastopf can handle unknown attacks of the same type. While the implementation may be slower and more complicated, we remain ahead of the attackers until they come up with a new method or discover a new flaw in our implementation.
• Modular design to add new logging capabilities or attack type handlers. Various database capabilities are already in place. HPFeeds logging is supported for centralized data collection.
• Popular attack type emulation is already in place: Remote File Inclusion via a built-in PHP sandbox, Local File Inclusion providing files from a virtual file system and HTML injection via POST requests.
• Adversaries usually use search engines and specially crafted search requests to find their victims. In order to attract them, Glastopf provides those keywords (AKA “dork”) and additionally extracts them from requests, extending its attack surface automatically. As a result, the honeypot gets more and more attractive with each new attack attempted on it.
• We will make the SQL injection emulator public, provide IP profiling for crawler recognition and intelligent dork selection.

Installation

cd /opt
sudo git clone https://github.com/mushorg/glastopf.git
cd glastopf
sudo python setup.py install

Configuration

cd /opt
sudo mkdir myhoneypot
cd myhoneypot
sudo glastopf-runner

A new default glastopf.cfg has been created in myhoneypot, which can be customized as required.

sudo glastopf-runner



2013-03-14 08:34:08,129 (glastopf.glastopf) Initializing Glastopf using "/opt/myhoneypot" as work directory.

2013-03-14 08:34:08,130 (glastopf.glastopf) Connecting to main database with: sqlite:///db/glastopf.db

2013-03-14 08:34:08,152 (glastopf.modules.reporting.auxiliary.log_hpfeeds) Connecting to feed broker.

2013-03-14 08:34:08,227 (glastopf.modules.reporting.auxiliary.log_hpfeeds) Connected to hpfeed broker.

2013-03-14 08:34:11,265 (glastopf.glastopf) Glastopf started and privileges dropped.

2013-03-14 08:34:32,853 (glastopf.glastopf) 192.168.10.85 requested GET / on 192.168.10.102

2013-03-14 08:34:32,960 (glastopf.glastopf) 192.168.10.85 requested GET /style.css on 192.168.10.102

2013-03-14 08:34:33,021 (glastopf.glastopf) 192.168.10.85 requested GET /favicon.ico on 192.168.10.102