skip navigation

honeypots for windows
Honeypots for Windows
by Roger A. Grimes
Apress 2005
progress indicator progress indicatorprogress indicator progress indicator


W= parameter

defined, 126

war drivers

using wireless honeypots to detect, 9

Web.sh script

source code for, 177–178

website addresses

for 4-clause BSD license, 122

for Active@ UNDELETE program, 315

for Active@ UNERASER program, 315

for Activeworx, Inc., 293

for Advanced Attachments Processor tool, 315

Afind program, 312

for Akonix L7 Enterprise tool, 317

for AllAPI, 343

for “An Evening with Berferd” paper by Bill Cheswick, 20

ArcSight, 294

Argus for Linux, Unix, and Solaris users, 309

AT&T Mexican honeynet, 8

for author of this book, 166

for Back Officer Friendly (BOF) honeypot, 189

for Back2Life program, 315

Bait and Switch Honeypot, 10

Blat utility, 299

for bootable CD-ROM for GenII honeywall, 25

Bugbear worm, 77

for Cache Reader tool, 316

for CacheInfo tool, 316

for CacheX utility, 316

Center for Internet Security, 40

CM utility, 276

Comcraft tap maker, 44

ComLog utilities, 23

for common NetBIOS enumeration tools, 77

for community support for Snort, 250

for comprehensive listing of TCP/IP ports, 65

Computer Associates, 294

Computer Forensics, Cybercrime and Steganograph Resources, 335

for CookieView tool, 316

Crucial ADS, 313

for DataGrab, 317

for DBXpress tool, 315

DCF Software’s Hard Disk Copy, 308

Dd.exe command-line tool, 306

for a detailed discussion on IPSec, 106

for details about SRP, 107

for the Developer.com Windows API Tutorial, 343

DiamondCS forensic utilities, 283

DiamondCSOpen Ports utility, 276

DiamondCSPort Explorer utility, 276

Digital Detective’s hashing tool, 312

for Directory Snoop, 314

for disabling Windows File Protection, 281

for disk editor programs, 314

for The Disk Investigator program, 314

for downloading ActivePerl Perl engine, 145

for downloading a Honeyd configuration file, 161

for downloading Cygwin, 142

for downloading GUI-based installers and management tools for Snort, 268

for downloading Honeyd emulation scripts, 132, 146

for downloading MASM, 350

for downloading ms-ftp.sh script, 183

for downloading Snort, 146

for downloading tcpdump utility, 249

for downloading the Windows version of gawk, 188

for downloading the Windows version of sed, 188

for downloading WinDump utility, 141, 249

Dr. Fred Cohen, 21

for ECMAScript scripting standard, 170

EditPlus text editor, 357

eEye Digital Security, 27

Electronic Evidence Information Center, 335

for E-Mail Detective, 315

EnCase software, 308

Engage Security, 296

for Ethereal install executable, 147

Ethereal network protocol analyzer, 43

EventCombMT application, 288

for Eventlog to Syslog Utility, 290

Exploiting Software: How to Break Code (Greg Hoglund and Gary McGraw), 359

for Faketelnet.pl script, 179

Febotti Command Line utility, 299

File Investigator, 314

FileCheckMD5, 312

for FINALeMail tool, 315

Foundstone utilities, 276, 280, 335

for Foundstone’s Attacker, 190

Foundstone’s Bin Text utility, 318

for Foundstone’s Fport and Vision utilities, 276

for Foundstone’s Galleta tool, 316

for Foundstone’s NTLast utility, 321

for Foundstone’s Pasco tool, 316

for Foundstone’s Rifiuti utility, 315

for ftp.sh script, 180

for GFI LANguard Security Event Log Monitor, 289

GhostRAdmin remote-access trojan, 333

for GlobalSCAPE’s Cute FTP, 178

for Guild’s FTP Server, 202

Hacking Disassembly Uncovered (Kris Kaspersky, et al.), 359

HD95Copy, 308

HFind tool, 313

for High Level Assembler (HLA), 352

for Hogle trojan virus, 207

Hogwash, 52

Honeycomb research tool, 7

Honeyd (honeypot daemon), 121

for the Honeyd Development web site, 33

for Honeydscan.tar script, 179

for Honeyd.tar script, 179

for the Honeynet Project, 33

Honeynet Project Scan of the Month, 248

for the Honeynet Project’s Scans of the Month, 324

for “Honeypots: Are They Illegal?” paper (Lance Spitzner), 33

for Honeypots: Tracking Hackers honeypot information, 33

for Honeypots.net, 219

for HoneyWeb-0.4 tgz, 179

IBM, 294

IDA Pro Disassembler and Debugger, 318

for iisemu18.pl script, 180

for IM Grabber, 317

Implementing CIFS, “Introduction”, 77

InCtrl5 (PC Magazine) utility, 283

for information about disabling LM hashing, 119

for information about EFS data recovery agent, 107

for information about event IDs, 323

for information about EVENTTRIGGERS command, 299

for information about GPOs, 119

for information about JavaScript or JScript, 170

for information about Perl, 168

for information about Ping of Death attacks, 237

for information about settings for hardening TCP/IP stacks, 104

for information about Smurf attacks, 237

for information about VBScript, 170

for information about Visual Basic languages, 170

for information about Windows command-line shell language, 169

for information about Windows STOP errors, 306

for InfoWorld summary article about SIM/SEM, 294

Intrusion Inc. tap maker, 44

Jackpot SMTP tarpit, 9

for JpegDump tool, 315

for KaZaA .dat Viewer, 317

KeyFocus Ltd. KFSensor honeypot, 196

for KeyFocus’s HTTP engine that runs as a web server, 202

KFSensor honeypot, 196

Kiwi Syslog, 290

for Kuang2.pl password-stealing trojan script, 179

LaBrea tarpit, 9, 190

for the latest Honeyd version, 123

for learning which file extensions are associated with which programs, 314

LibnetNT, 191

list of BIOS interrupt routines, 341

for a list of disassemblers, 357

for Log Parser in Microsoft IIS 6 Resource Kit, 289

for MACS security event log collection information, 289

Malware: Fighting Malicious Code (Ed Skoudis and Lenny Zeltser), 359

for the MBlaster worm, 181

for MBlaster worm article by Laurent Oudot, 181

for MBlaster worm document by Dr. Niels Provos, 181

MessageLabs antispam resource, 304

for Michael Davis, 121

for Microsoft network model information, 227

Microsoft Security Baseline Analyzer tool, 101

Microsoft Security web site, 41

for Microsoft’s Automated Deployment Services, 306

Microsoft’s ExMerge utility, 315

for more hashing program alternatives, 312

for Mydoom.pl script, 179

National Security Agency, 40

nbtscan enumeration tool, 77

Net Send Command Line utility, 299

NetBIOS Auditing Tool, 77

NetBIOS enumeration tools, 77

“NetBIOS: Friend or Foe?, 77

for NetBIOS information, 77

for NetBIOS name suffix information, 74

Netcat utility, 14, 81

netForensics, 294

for Netsky worm, 265

for Network General’s Sniffer, 43

for Network Sniffer’s Netasyst Network Analyzer, 246

NISER Computer Forensics Laboratory, 335

Nmap active fingerprinting tool, 27

for Nmap documentation, 156

nmapNT active fingerprinting tool, 27

NMapWin, 27

for Norton System Utilities, 315

NT Objective’s ntoinsight’s, 316

Open Ports utility, 276

Open Watcom assembler, 352

for open-source Windows forensics tools, 335

for OSI model, 227

for OutlookRecovery tool, 315

for packers, 358

for PatriotBox honeypot, 212

for PE Explorer disassembler, 355

for Perkeo program, 317

for Photo Retriever tool, 315

for Pictuate program, 317

for POf passive fingerprinting tool, 43

POF utility, 311

for pop3.sh script, 180

for Pop.emulator.tar.gz script, 180

for presentation about ICMP fingerprinting, 29

ProDiscover software, 308

Provos, Dr. Niels, 121

Putty SSH program, 284

Remote Administrator, 333

Rugrat virus, 93

SafeBack software, 308

Sebek, 23

Secure Hash Signature Generator, 312

SecurIT Informatique Inc. utilities, 281

Security Assertion Markup Language (SAML), 291

for SecurityFocus honeypot mailing list, 166

SecurityProfiling, Inc., 121

Sendmail, 215

ServerSentry utility, 299

SFind utility, 313

for shell command language information, 168

The Shellcoder’s Handbook: Discovering and Exploiting Security Holes, 359

Slammer worm, 303

for Small Is Beautiful (SIB) assembly language starter kit, 353

for smtp.sh script, 180

Snort-inline, 52

for SpinRite, 339

for SpyAgent software, 317

for Ssed program, 318

Strings.exe program, 350

SuperDIR, 312

for Symantec’s Norton Ghost, 306

Symantec’s Norton System Utilities, 314

Sysdiff, 272

for Sysinternal’s Hostname utility, 311

Sysinternal’s PendMove utility, 319

Sysinternal’s Stream program, 313

for Sysinternal’s String.exe program, 311

for Sysinternal’s Strings utility, 318

Sysinternal’s TCPView utility, 276

TamoSoft SmartWhois query tool, 311

TCPView utility, 276

TextPad text editor, 357

Thing Trojan, 350

for Tracking Hacker’s web site, 219

for Tribble, 306

TUCOFS-The Ultimate Collection of Forensic Software, 335

for tutorials on PE files and their structure, 349

for Unix version of Tripwire program, 23

for updated Nmap.prints file, 151

UPX packer, 358

for “Using Microsoft Windows IPSec to Help Secure an Internal Corporate Server”, 106

for utilities for checking permissions, 314

for virtual machine honeypots in forensic analysis whitepaper, 309

VMware, 16

for Webster’s Art of Assembly Language tutorial, 346

for Webster’s web site for assembler information, 353

Welchia worm, 182

WhatFormat program, 314

for WildPackets’ EtherPeek NX, 246

for the Win32 API FAQ, 343

Winalysis, 274

Windiff, 272

Windows Forensic Toolchest (WFT), 274

for Windows GUI for nmapNT, 27

Windows implementation guides, 284

“Windows Internet Naming Service (WINS): Architecture and Capacity Planning”, 77

Windows IT Pro magazine, 41

Windows Update Services (WUS), 102

for Windows version of Tripwire program, 272

WinDump utility, 309

Winfingerprint, 272

Winfo enumeration tool, 77

for Wingate proxy server, 206

Winhex software, 308

WinInterrogate, 272

WinMessenger utility, 299

WinPcap, 191

WinPcap packet capture driver, 43

for WinRAR tarball unzipper, 178

for WinZip tarball unzipper, 178

Xprobe2 active fingerprinting tool, 27

for Xprobe2 and fingerprinting article, 28

Webster’s Art of Assembly Language

tutorial for learning assembly language, 346

Webster’s HLA support page

website address, 352

Welchia worm

website address, 182

WhatFormat program

for determining a files real content, 314

website address, 314

WhiteDoe real honeypot

bogus .system directory in, 334

finding exploit code on, 332–335

hacker’s malicious folder structure, 333

lessons learned from the attacks on, 335

R_bot.ini IRC configuration file, 334

whitehat vulnerability testing tools

coding of in Perl, 168–169

whois query tools

TamoSoft SmartWhois, 311

WildPackets’ EtherPeek NX

website address, 246


website address, 343

Win32 API files

main for Windows core functionality, 342


snapshot comparison screen, 273

website address, 23, 274


website address, 272

Window Size field

in TCP, 234


NET SEND command for sending short console messages in, 296

website address for implementation guides, 284

Windows 2000 domain controller ports

list of common, 69–70

Windows 32-bit executables

known as Portable Executables (PE files), 348–349

Windows API

housekeeping tasks handled by, 341

resources for learning how to use, 343

using, 341–343

Windows API files

searching for a larger list of, 342

Windows applications

common and their port numbers, 86–87

Windows command-line shell language

using for Honeyd service scripts, 169

Windows Computer Management Services window

configuring services in, 108–109

Windows event logging, 285–286

main auditing categories, 286–287

Windows event triggers

using, 298–299

Windows File Protection

disabling to use ComLog, 281

website address for disabling, 281

Windows Firewall

filtering network traffic on your honeypot with, 105–106

Windows Forensic Toolchest (WFT)

website address, 274

Windows honeypot deployment, 89–120

decisions to make for, 89

Windows honeypot emulation

common ports and services, 65–68

Windows honeypot modeling.

See also honeypot modeling

port-related protocols and services review, 63–65

Windows implementation guides

website address, 284

“Windows Internet Naming Service (WINS): Architecture and Capacity Planning”

website address, 77

Windows IT Pro magazine

website address, 41

Windows Performance Monitoring console

using to collect network traffic baseline data, 275

Windows personalities

annotation syntax, 156–157

common choices of, 156

Windows platform

tarball unzippers for, 178

Windows ports and services

list of common, 66–68

Windows protocols, 237–239

Windows security audit files

events of interest in, 292–293

Windows security log analyzer

NTLast as, 280

Windows Server 2003

editions available in, 91

Windows server ports

list of generic, 68–69

Windows services

for honeypot modeling, 72–83

steps for hardening, 116–117

Windows Services Startup type settings

recommended on a Windows Server 2003 computer, 109–115

Windows STOP errors

creating intentionally, 305–306

website address for information about, 306

Windows TCP/IP stack

Microsoft use of a four-layer network mode to describe, 227

Windows Terminal Server

RDP protocol used by, 78

Windows Update Services (WUS), 17

checking for system patches with, 102–103

website address, 102

Windows workstation ports

list of common, 70

Windows XP

Remote Desktop in, 78

Windows-based honeypots

Honey-Potter as, 219

other than Honeyd, 189–220

WinDump utility

confirming successful installation of WinPcap with, 141–142

determining the number of collected network packets with, 309

using with Ethereal protocol analyzer utility, 249

website address, 309

website address for downloading, 141, 249


website address, 272

Winfo enumeration tool

website address, 77

Wingate proxy server

website address, 206

Winhex software

website address, 308


scanning local files, 274

website address, 272

WinMessenger utility

website address, 299


confirming successful installation of, 140–141

conflicts with some Ethernet cards, 142

needed to run LaBrea tarpit, 191

steps for installing using the auto-installer package, 140

website address, 43, 140, 191

WinRAR tarball unzipper

website address, 178

WinZip tarball unzipper

website address, 178

wireless access points (WAPs)

exploitation of weakly protected, 9

workstation ports

list of common Windows, 70

worm catcher script, 180–181

worm cleaners

problem with, 182

WU-FTPD daemon

developed at Washington University, 168

progress indicator progress indicatorprogress indicator progress indicator

Honeypots for Windows
Honeypots for Windows (Books for Professionals by Professionals)
ISBN: 1590593359
EAN: 2147483647
Year: 2006
Pages: 119

Similar book on Amazon
Honeypots: Tracking Hackers
Honeypots: Tracking Hackers
Know Your Enemy: Learning about Security Threats (2nd Edition)
Know Your Enemy: Learning about Security Threats (2nd Edition)
Virtual Honeypots: From Botnet Tracking to Intrusion Detection
Virtual Honeypots: From Botnet Tracking to Intrusion Detection
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net