Comments on: Kippo SVN build

By: Ion

Ion — Fri, 09 Dec 2011 13:32:44 +0000

Another thing to note (as per https://code.google.com/p/kippo/wiki/FAQ – last comment) is the size of max_allowed_packet in the MySQL configuration. Mine (mysql-server package at ubuntu server 11.04 32 bit) was at 16mb by default though (cat /etc/mysql/my.cnf | grep max_allowed_packet)

By: Andrew Waite

Andrew Waite — Mon, 28 Mar 2011 08:28:28 +0000

Nice work Dave, just had a read through and sounds nice and easy. Now know what I’ll be doing next time I get some free lab time

Cheers for sharing with the rest of us.

By: Dave Eddy

Dave Eddy — Sun, 27 Mar 2011 20:27:14 +0000

http://www.daveeddy.com/tutorials-scripts/ubuntu/ajaxterm-for-kippo-logs/

Not sure if the last one posted or not i think my browser messed up… anyways enjoy

By: Dave Eddy

Dave Eddy — Tue, 22 Mar 2011 05:53:50 +0000

yeah definitely! i’ll get it up sometime this week.. i have heavily modded the ajaxterm.py file to make it more secure so i’ll zip that up and post it as well

By: Andrew Waite

Andrew Waite — Fri, 18 Mar 2011 09:13:50 +0000

Nice work! Just watched the first capture, always good for a laugh.

Couldn’t see anything on your blog, any chance you could write-up process for get the ajaxterm running? It’s been on my to-do list for a while (and know others who are looking at the same thing), a decent install guide would be useful.

By: Dave Eddy

Dave Eddy — Fri, 18 Mar 2011 00:58:24 +0000

I’ve actually had this running for a little under 2 days and have already had two people try and connect! one was really funny to watch, they wget some tools, and i had a laugh watching them try to make a user and have to put in a “favorite movie”.

The second person connected and then disconnected right after, but got stuck in the fake localhost prompt, and then quit out… awesome stuff haha!

I got the ajaxterm up and running on my webserver (as the same limited user that runs the honeypot) and i created a basic php script that automatically lists the logs on my server.. check it out http://daveeddy.com/kippologs/

By: Andrew Waite

Andrew Waite — Thu, 17 Mar 2011 06:42:43 +0000

Seems it catches most people out. Glad you got it running.

Let us know if you get any interesting results.

By: Dave Eddy

Dave Eddy — Thu, 17 Mar 2011 04:55:06 +0000

Thanks! i was trying to figure out why it wasn’t working… it was the [database] commented issue.

By: Tomasz Miklas

Tomasz Miklas — Sun, 25 Jul 2010 12:56:06 +0000

Oh… and when editing kippo.cfg don’t forget to uncomment ‘[database]‘ – I’ve lost 25 sessions… that’s what you get when you fall asleep working :/