Simple Java IDS/Honeypot - Honeyjar

Well I've been learning Java so I decided I might as well code something worth while as I learn which I would actually use. So I figured I would make a simple program which opens up a socket and listens on it for incoming scans or connection attempts. It then sends fake banners and logs the attackers input and IP. It also does a whois lookup on the attackers IP. Keep in mind I'm still learning so the code may not be as efficient as it could be, but it does the job. If anyone has suggestions or make their own improvements on it than please feel free to send me a copy in a comment. It comes with two premade listeners and one for you to put your own custom message if you want.

Anyhow, here it is. Enjoy, someone finds it useful whether it be to learn from it or to use it. If you make any improvements or have any suggestions than feel free to comment!

Here's the source, keep in mind I'm still working on it. Only posting it because I've been a bit busy lately so I haven't had time to post or to finish this.

Source - http://pastebin.com/rJxEPYeT
Jar - http://www.mediafire.com/?5cepfpx9bqdasf3

Useage: java -jar honey.jar

The rest is self explanatory.

Java Regex Example for IP's

I've been learning Java lately so I figured I would post this quick Regex example. This code can be used to grab IP's out of a string and display them using regular expressions(Regex).

http://pastebin.com/cHmS804v

Fluxbox on BT4

Well I personally am not a huge fan of KDE so I decided to make a switch to a lightweight windows manager which I'd enjoy. Fluxbox was an easy switch as I found out. Below I will show you how to make the switch.

First off you should make sure you're all up to date. Once you've done that run "apt-get install backtrack-dragon" to make sure it's installed and up to date as well. Now run backtrack-dragon with the command "dragon" which will prompt you with usable commands. We will now change the default WM to Fluxbox like so;

desktop fluxbox

Now in a new shell we will actually switch to flux now;

flux-for-back -s

You will be prompted with some possible commands, we will be using either option 1 or 2. I choose 1, but if you want icons with flux choose 2. Once you issue the command it will begin making the switch, which may take a moment or two. After it's completed if it doesn't switch than you may have to reboot, which will boot running flux as we set that to be the default WM.

Screenshot taken with imagemagick, you can also see how to add images to your users backgrounds;

import -window root flux.png

Do note though, Fluxbox takes a bit of configuring and isn't quite so user friendly, but it's really not to complicated and kicks ass.

Medusa Bruteforcer

Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible. The author considers following items as some of the key features of this application:

• Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.
• Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing.
• Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing. 

This tool could be used with one of the dictionaries I posted to test the security of your password, or by someone trying to bruteforce into your SSH for example. This is just another reason as to why you should choose a very secure password like S0meP4ss[1984] or something of the like. This way you don't have to worry about hackers trying to bruteforce your logins.

Example usage for bruteforcing SSH;

medusa -h IP Address -u username -P dictionary -O logfile -protocol

medusa -h 88.213.43.13 -u root -P /home/Desktop/dictionary.txt -O mlog -M ssh