Article URL: https://uphillsecurity.com/articles/harvesting-ssh-credentials-insights-from-my-honeypot-network/ Comments URL: https://news.ycombinator.com/item?id=49146605 Points: 1…

I’ve been working on this honeypot network for the past couple of months, and I’d now like to share some information from the first 30 days. The project is still work-in-progress and I plan to improve it over time. The presentation is still a little bit rough, but this will do for now. Reminder: - Passwords and usernames are percent-encoded (like an URL) to provide the information lossless and fully reversible - use Cyberchef to reverse it. Access to ALL credentials from the past months: - https://git.uphillsecurity.com/UphillSecurity/open-honeypot-data/ I’ll keep it simple - still a mess, but a top-level view might still be interesting. Found some open-source candidates but they were either too ‘old’ or bloated so I’ve decided to do myself with the help of AI. I’ve used Python and Paramiko for the SSH handling. In short: low-interaction honeypot for SSH that saves the logs locally. Gathering the logs is being done with Ansible as well. Been using ipgeolocation.io to fetch the additional information about the GEO locations, ASN information, etc.