[Dshield] webhoneypot

Manuel lists at grospolina.org
Wed Dec 3 00:03:20 GMT 2008


you wrote:
>The data will eventually be used like DShield data.
eventually. i have nothing to say about.
but: yes or no?
>E-Mail the modifications and templates directly to me (jullrich at
>euclidian.com ). Zip them up as an attachment. One of the missing pieces I
>still need to fix is a script to push updated templates to users.
i sent, but no reply.
I tar.gz'd MY current templates.

And, understanding the fact, that your last newsletter was the only
one i got since 2003 (guessing, i'm not sure about the date when i
described to dshield.),
it seems that you have an issue with sending and receiving mails, not
me.

-------
changes to index.php:
line 48 ff,

/* collect the request */
$sRequest=collect_request();
logdata("Debug: Done collecting request. Size=".strlen($sRequest)." Bytes",8);
logdata("$sRequest");
/* posting the request to the collection site */
//$sResult=post_result($aConfig,$sRequest);
//logdata("Debug: Post result = $sResult");

/* deliver the template to the client */
deliver_template($_SERVER['REQUEST_URI']);
logdata("Debug: Template delivery done");

/* posting the request to the collection site */
$sResult=post_result($aConfig,$sRequest);
logdata("Debug: Post result = $sResult");

To curl something and, when done, deliver the page to client is usefull
on using curl to download the attackers included page and display
result to them to get spreaders, bots and shells.
... no need to act in this way for posting to isc1.
-------

greets,
Manuel




More information about the Dshield mailing list