Posts

Now we get into the part of the project that I have little to no experience in. While I have used the tools, I don’t have years of working knowledge and I have certainly never combined them in this way in an attempt to build a narrative around an attack. Thus enter my good buddy Claude to fill in the gaps. I knew what I wanted, but not how to get there. I have been in school with SANS for some time now and while I have learned an absolute ton, I don’t claim myself to be an expert in anything. Since this is my first experience setting up a honeypot like this, I started reading about different ways to parse the data… and man there are a lot of them. I decided that while I could follow a write up of someone that had come before me to the letter and have a working solution in no time, I would probably learn more by explaining what I wanted to AI and having it coach me through the process. ...

Next came the network. For the deployment of the device I chose the office. I am at work more than I am at home and it also offers a lot more in terms of security and configurability. This will likely remain after the internship so that I can continue to play with it. Also, it can’t hurt to have something sitting in our block that looks like a juicy target. It’s a long shot but if someone scans our block and sees this maybe they will waste time here instead of on my actual assets. ...

Finally found a cool use for the old Pi 4 I bought years ago. I bought it just because I have a need to collect all things technical in nature. The SANS ISC internship is giving me the perfect opportunity to put it to use! Since it had been years I decided on a fresh install of the OS. I downloaded the latest Raspberry Pi Imager and followed the simple steps to creating a bootable microSD for my soon to be Honey Pi (yes a perfect name… you can hold your applause). I highly recommend during this process to setup the Raspberry Pi Connect as it helped me get to the thing remotely when I made a mistake on the networking side later on in the setup. Also, the imager will give you an option to go ahead and load your SSH Keys, I would do this as well since it makes connecting via SSH that much easier later on. ...