Some octets of external IP addresses have been replaced with an “X”. The MD5 hash in the authorization digest is replaced with “ MD5_hash_removedXXXXXXXXXXXXXXXX”. In terms of geolocation, pick your favorite city. The IP address of the honeypot has been changed to “ .removed”. Unknown parties scanned the honeypot with a range of tools, and this activity is represented in the log file. log.txt which was generated from an unadvertised, passive honeypot located on the internet such that any traffic destined to it must be nefarious. This challenge was designed to examine and explore some of the attributes of the SIP and RTP protocols.” As this technology becomes more common, malicious parties have more opportunities and stronger motives to control these systems to conduct nefarious activities. VoIP is becoming the de-facto standard for voice communication. This challenge takes us “into the world of voice communications on the internet. The trace includes a secret hidden message. Which RTP packet header field can be used to reorder out of sync. What was the password for the account with username 555?. 
How long is the sampling time (in milliseconds)?.Which codec does the RTP stream use? (3 words, 2 spaces in between).What are the default credentials used in the attempted basic authentication? (format is username:password).Provide the first 11 digits of the number dialed from extension 101? Multiple real-world phone numbers were dialed.What is the corresponding user-agent? (two words, once space in between)
There is a trace for a real SIP client.How many extensions were scanned in total?.Which extension on the honeypot does NOT require authentication?.Which tool was only used against the following extensions: 100, 101, 102, 103, and 111?.“What is the User-Agent of the victim system?”.The attacker used a bunch of scanning tools that belong to the same suite.What is the transport protocol being used?.No longer book expository this time since much of the setup/explanatory bits from it apply here as well).
0 kommentar(er)
