Improving Glastopf

Last saturday I’ve finally released a new Glastopf version. There are some new features and many changes under the hood.

New implemented features:

LFI (Locale File Inclusion) handler: He is back! I have lost him somehow during coding and now he has his own handler. I am looking forward to get some data for attack method comparison. Furthermore he is one possible first layer for RCE (Remote Code Execution) attacks. So I am also curious if I’m catching some of those attacks.

IRC logging module: This is a request/response bot. The request gets translated into a MySQL query whose results are replied to the requester.

Twitter logging module: Now the Twitter module is integrated into Glastopf. It’s fun to lean back and watch him doing his work!

Important changes in existing modules:

Dynamic dork list: I am collecting unknown dorks from attacks against the Honeypot since a while and someday I thought it would be fun to serve them all to the search engine crawlers. So I generated a list containing 17k (a still growing number) dorks. This noticeably raised the number of hits against the Honeypot.

Plans for the next two weeks:

The central database lacks an easy to handle and public shareable interface.

The vulnerability database needs some cleanup and the collected data should be analyzed.

I am planning some geolocation analysis of the attacker IPs.

Glastopf’s vulnerability emulator is one of the central parts when handling attacks. I’ve improved the concept and a first version is finished and will be implemented during the next weeks.