Web-based honeypot for detecting and tracking attackers

Computer Engineering

Recently due to advancement of new technologies, various types of attacks on websites and webservers have also increased, some of them majorly include cross-site scripting (XSS) and SQL injection attacks which are used to spoil the vulnerability of the system and steal confidential data of the users like their user ID’s and passwords from the server databases. Many methods were proposed to prevent such attacks. Some of them were created to learn about pattern of attacks and behavior of the attacker. That is honeypot. Honeypot is classified into two types based on the simulation that honeypot does, low interaction and high interaction. In this project a low-interaction honeypot is proposed for emulating vulnerabilities that can be exploited by XSS and SQL injection attacks. This honeypot not only records attacker's request, but it also tries to expose attacker’s identity by using browser exploitation techniques. Some have methods to hide their identity, thus they couldn't be tracked. Hence the proposed honeypot tries to overcome this problem by sending attackers a malicious JavaScript code. This JavaScript code will be run when an attacker opens the honeypot's website. The code steal attackers’ confidential information like social account information by using Like Jacking technique, their IP and MAC addresses although even if they have used proxy or TOR to hide their identity. These information helps us to locate the attacker geographically by using some in-built packages and software that takes IP or MAC addresses as the input and provide its location as an output.

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.