Web Application Honeypot Threat Intelligence
summary
OWASP Web Application Honeypot Project claims a working proof of concept that uses ModSecurity + CRS on VM, Docker and Raspberry Pi nodes to capture attacks, tags interactions with fake robots.txt & hidden fields and streams ModSecurity JSON into ELK for visualization and into ELK -> MISP (STIX/TAXII) for sharing. Old consoles are broken so the build reboots collection with Docker, Logstash/Kibana, MISP integration; next steps are probe management at scale and ML to auto-update rules.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:09Why OWASP Web Honeypots (Part 2)?
- 4:26Consider the WAF - Web Application Firewall
- 6:06The WAF as a Honeypot or Probe?
- 8:03Mod Security - An Open Source Web Application Firewall
- 13:49Original Project
- 15:56Proof of Concept Layout (in Docker format)
- 18:37Honey Traps
- 25:41Proposed Next Stages
related talks
26mWeb Honeypot Project
32mFaking a Factory: Creating and Operating a Realistic Honeypot
37mAutomatic Extraction of Indicators of Compromise for Web App.
34mWhat Minesweeper Can Teach Us About Security
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
26mLooking at 4 years of web honeypot attacks: tactics, ...
57mEnterprise Ethical Hacking Cloud Applications
35mCyber Deception 2.0: Adaptive Honeynets and Canary Intelligence in Production