Week 10/11
- Milestone 0: To The Cloud!
- Milestone 1: Create MHN Admin VM
- Milestone 2: Install the MHN Admin Application
- Milestone 3: Create a MHN Honeypot VM
- Milesotne 4: Install the Honeypot Application
- Milestone 5: Attack!
Which Honeypot(s) Was Deployed:
- Dionaea with HTTP
- Wordpot
- p0f
- Snort
Issues Encountered: Accessing the admin console via the "superuser" values by loading the external IP in a browser proved to be an issue. When running the command "sudo supervisorctl status" there was an error with mhn-celery-worker which claimed to be fatal.
Attack Summary:
Top 5 Attacker IPs:
- 61.160.215.38 (570 Attacks)
- 35.225.81.112 (333 attacks)
- 77.247.109.54 (178 attacks)
- 180.168.46.118 (174 attacks)
- 93.115.29.78 (88 attacks)
Top 5 Attacked Ports:
- 80 (574 times)
- 5060 (509 times)
- 445 (285 times)
- 1433 (191 times)
- 8088 (164 times)
Top Honey Pots:
- dionaea (2,954 attacks)
- p0f (34 attacks)
- snort (6 attacks)
Top Sensors:
- mhn-honeypot-1 (2,961 attacks)
- mhn-honeypot-3 (40 attacks)
- mhn-honeypot-4 (6 attacks)
TOP Attack Signatures:
- ET DROP Dshield Block Listed Source group 1 (4 times)
- ET CINS Active Threat Intelligence Poor Reputation IP TCP group 81 (1 times)
- ET CINS Active Threat Intelligence Poor Reputation IP TCP group 56 (1 times)
- ET CINS Active Threat Intelligence Poor Reputation IP TCP group 49 (1 times)
- ET SCAN Suspicious inbound to mySQL port 3306 (1 times)