5. The ghost page - A honeypot does not have to be an entire system, sometimes content itself can perform the job - especially if it is content that a normal user would never discover. Most web vulnerability scanning tools will access a list of common locations for forms in known-vulnerable web applications.

While common Intrusion Detection systems will detect these (and a good SIEM correlation ruleset can look for these URIs in the logs from the webservers themselves), there is a missing piece of the puzzle here - the webserver will report '404 not found' to these pages - and the scanner moves on to the next system. But what if the webserver reported with Error 500 - indicating that the page is present, but a server-side error has occurred? Our attacker may stay focussed on this one system (wasting their time and effort) and providing us with much more information. (a technique often referred to in other contexts as 'tarpitting').

These honeypot methods, while all cheap to build and deploy, and requiring little additional analysis to make the intelligence they generate useful, are merely the tip of the iceberg of the art and science of building effective honeypot systems. There are few organizations making extensive use of honeypot deployments and those that do are mature enough that they tend toward the more complex installations.


This has led to the intimidation factor for many organizations to forego the use of honeypots as a security monitoring control. However, there are many levels of sophistication with this technique and a company does not have to implement something massively complex, to still obtain valuable information.

The use of honeypots, like everything in information security, is always evolving and the technique has a lot of potential to disrupt attackers by wasting their time and resources, directing them away from their true targets and forcing them to reveal themselves.

Collaborative projects such as The HoneyNet Project continue to develop tools to capture both directed and automated attacks and integrate honeypots directly into malware analysis sandboxes. Sinkholes and tarpits to redirect and trap command and control channels for botnets are a cousin to the honeypot that is proving to be an effective active countermeasure against malicious software networks.