Honeynet Project Scan of the Month Challenge for April - Open Proxy Honeypot

From: Ryan Barnett (RCBarnett_at_hushmail.com)
Date: 04/02/04

  • Next message: Strand, John: "CISCO IDS Packet capture" 
    Date: 2 Apr 2004 04:10:48 -0000
To: focus-ids@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Greetings all,
    This month's challenge is to analyze web server log files looking for signs of abuse. The Honeypots: Monitoring and Forensics Project (http://honeypots.sourceforge.net) deployed an Apache web server that was configured as an Open Proxy. Your job is to analyze the log files and identify/classify the different attacks (trust me, there are a surprising number of them :). All entries are due Friday, 30 April. Results will be released Friday, 7 May.

    Before analyzing the web logs, Please review the honeypot whitepaper entitled Open Proxy Honeypot (http://honeypots.sourceforge.net/open_proxy_honeypots.pdf) for in depth details of the configurations. This paper will provide important background information to aid in your analysis of the SoTM data.

    Good Luck!
    Ryan C. Barnett
    SANS Instructor: Securing Apache
    GCFA, GCIH, GCUX, GSEC

    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------

  • Next message: Strand, John: "CISCO IDS Packet capture"