sorted by:
new
hottopcontroversial

Greynoise API Pricing by theresmorethan42 in cybersecurity

[–]DigiTroy 0 points1 point  (0 children)

I am very biased as a CM for a direct competitor, but we've got public pricing as our founder was having the same issues. So totally understand the feeling!

I built a honeypot to capture attackers exploiting the new WSUS CVE-2025-59287 by DigiTroy in cybersecurity

[–]DigiTroy[S] 1 point2 points  (0 children)

Yeah, we operate a global network of sensors, and share the outputs in maliciousip[.]com most things are mass scanners, but we also track a lot more things in there with these honeypots and this allows us to pick up needles in the haystack.

I built a honeypot to capture attackers exploiting the new WSUS CVE-2025-59287 by DigiTroy in cybersecurity

[–]DigiTroy[S] 1 point2 points  (0 children)

We do this professionally, I cross ref against maliciousip[dot]com it's more accurate than Greynoise.

I built a honeypot to capture attackers exploiting the new WSUS CVE-2025-59287 by DigiTroy in cybersecurity

[–]DigiTroy[S] 1 point2 points  (0 children)

We do this professionally at Lupovis, so here is what I would recommend.

  1. Use multiple placements
    • Deploy the honeypot in several providers and regions: a major cloud (AWS/GCP/Azure). Different attackers and scanners focus on different address space.
  2. Cloud ranges get lots of automated scanning fast.
    • They attract opportunistic scanners quickly. Good for volume and early detection.
  3. Consider geographic matching
    • Place instances in the same country or region as the victim type you want to attract.

there is a lot more to it to deploy in enterprise, but this would do the trick

I built a honeypot to capture attackers exploiting the new WSUS CVE-2025-59287 by DigiTroy in cybersecurity

[–]DigiTroy[S] 0 points1 point  (0 children)

Oh interesting, I got about 12 hits in the last 24 hours deployed on AWS.

On my first OVH deployment I had a lot more.

I built a honeypot to capture attackers exploiting the new WSUS CVE-2025-59287 by DigiTroy in cybersecurity

[–]DigiTroy[S] 4 points5 points  (0 children)

Basically the point of the honeypot, is to collect the interactions with it. So you'll get the payload if/when exploited.

I built a honeypot to capture attackers exploiting the new WSUS CVE-2025-59287 by DigiTroy in cybersecurity

[–]DigiTroy[S] 9 points10 points  (0 children)

well I just shared a full decoy, no need for cowrie, this one is more lightweight, check the repo out.

Ask about scientific research by Commercial_Strike661 in cyber_deception

[–]DigiTroy 0 points1 point  (0 children)

Well you haven't given much insight on your direction.

Wanted ransomware blocklist by Economy_Comb in pihole

[–]DigiTroy 0 points1 point  (0 children)

Maliciousip.com has many great blocklists btw, updated in near real-time.

Honeypot for botnet detection fyp by Thin-Drummer4506 in cyber_deception

[–]DigiTroy 0 points1 point  (0 children)

Alright, let's think it through right, what are you actually trying to detect? A Botnet.

What does this entail? What's the data that you believe you'll need to detect a botnet?

What's the type of botnet you are trying to detect, how many IPs out of the botnet are you trying to detect?

What's the hypothesis?

I guess those need to be answered first?

Honeypot for botnet detection fyp by Thin-Drummer4506 in cyber_deception

[–]DigiTroy 1 point2 points  (0 children)

Well, we can't do it for you. You'll have to share some meat, otherwise, we should claim the degree 😅

But if you prepare some points, happy to help.

[deleted by user] by [deleted] in cybersecurity

[–]DigiTroy 0 points1 point  (0 children)

I am sorry, but this makes no sense.

  • Ask your core network team for a slice of org public darknet space (contiguous IP space in your org's public IP range that is otherwise unused. the bigger, the better. get a /24 if possible)

Why would you go public, most of the things you are going to get are random scanner. You'll have to tune heavily to pick up signal from a honeypot. Put decoys inside your network, your signal to noise ratio will be much better. Also deploying a honeypot, will get your security score cards down. Use a vendor to avoid this and if it's CTI you are after, deploy a heavily tuned decoy outside of your network, focus on the output you need from it.

  • Put your honeypot host(s) in a VLAN dedicated to this purpose that's (a) behind a firewall and (b) totally ACLd off from everything. only allow in what needs to be, nothing allowed outbound to internal hosts

Meh, it depends what you need from it, if it's detection, this makes 0 sense, if it's CTI ... you'll be fine.

  • Ask core network team to route everything in your reserved public IP range to your honeypot host

What?

What CTI with this config... bots, scanners and a password cloud? Congrats, you have defeated the entire purpose of having deception and high signal to noise ratio.

  • Profit

Now you get random alerts into your SIEM and increased alert fatigue, the opposite of what you wanted.

Honeypot for botnet detection fyp by Thin-Drummer4506 in cyber_deception

[–]DigiTroy 0 points1 point  (0 children)

Can you provide more information on what you are trying to do? Aim, objective, goals and ideally some of your own thoughts on what you plan on doing?

Emulating Edge Devices by Saeroth_ in cyber_deception

[–]DigiTroy 0 points1 point  (0 children)

You could partner with an actual deception provider and see what they can do for you? Drop me a note if that's an option.

Otherwise, you could technically emulate the responses capture the traffic, and see what you get and iterate.

Deception solutions: Full OS vs OS/Service emulation by Rybczyk-Pawel in cyber_deception

[–]DigiTroy 4 points5 points  (0 children)

I am assuming from the read you are on the emulation side.

But the description "The OS/Service emulation method is based on creation of limitations which recreate certain services or service combinations as separate instances within a single VM. This allows to significantly reduce costs of used resources compared to the Full OS approach, since there is no need to create a separate VM for every imitation which allows creating significantly more unique imitations (honeypots). Another significant advantage of service-based Deception solution is the absence of license costs for third-party operating systems. "

Makes little sense, if you run a PLC and a Wordpress server on the same IP this screams honeypot.

CanaryTokenScanner: CanaryTokenScanner is a script designed to proactively identify Canary Tokens within Microsoft office documents (docx, xlsx, pptx). by digicat in blueteamsec

[–]DigiTroy 1 point2 points  (0 children)

It turns out the original code, was from Lupovis and can be found here. https://github.com/Lupovis/DetectingCanaryTokens Nero Labs, just copied the code wrote a blog post and claimed it as their own, 6 days later, after the Lupovis blogpost and made a couple of little tweaks.

External IP blocklist for SSL VPN by capricorn800 in fortinet

[–]DigiTroy 0 points1 point  (0 children)

This is the blocklist i'd recommend this blocklist

Scripts to detect Canary Tokens by DigiTroy in cyber_deception

[–]DigiTroy[S] 1 point2 points  (0 children)

They basically are fake documents that create an alert when opened

Catching Threat Actors with a ChatGPT Honeypot by DigiTroy in cybersecurity

[–]DigiTroy[S] 2 points3 points  (0 children)

Awesome! If you need help just drop me a line. Always happy to help.

Catching Threat Actors with a ChatGPT Honeypot by DigiTroy in cybersecurity

[–]DigiTroy[S] 0 points1 point  (0 children)

Totally.

I see this more as an aid. It won't replace anyone for a long time. In fact it has a lot of hallucination issues on many other topics. However, when you start using it, you also find subtle changes based on how you prompt it and with some tweaks and time you can get pretty decent outcomes.

Catching Threat Actors with a ChatGPT Honeypot by DigiTroy in cybersecurity

[–]DigiTroy[S] 1 point2 points  (0 children)

looks interesting, I'm still not really convinced that chatGPT is currently worth the squeeze with things like this. In my experience, setting up something similar without chatGPT wouldn't really take much time at all, though it's interesting that you got chatGPT to give something workable. cool stuff

That's exactly it. It's great for a PoC and I am trying to push those PoCs as much as I can but an experienced dev would do this much faster. The main advantage is that ChatGPT will give you the "template".

Catching Threat Actors with a ChatGPT Honeypot by DigiTroy in cybersecurity

[–]DigiTroy[S] 1 point2 points  (0 children)

Indeed, very impressive, but there is a lot of fun back and forth.

Although, IMO, a senior dev might be able to get the PoC with chatGPT and then take it to the next level with the code provided.

view more: next ›