Message Board

Installing Honey Pots

can subdomains use same php script?

Author: C.Miranda2 (6 Nov 13 11:37am)

I installed a honey pot on my site and have two other subdomains that I want to use it on. Can I use the same php file for all three or do I have to create one for each?

For example:
I install on www.example.com/honeypotscript.php
Can I use sub1.example.com/honeypotscript.php
Can I use sub2example.com/honeypotscript.php

Can all three use the same php file?

Thanks

Re: can subdomains use same php script?

Author: H.AnS (17 May 15 10:09am)

I would like to see an answer to this, too. Or rather I would like to see a confirmation that this works.

I have a multi-language Drupal site that provides subdomains like:
example.com
en.example.com
de.example.com

The subdomain determines the language of the user interface, but the content is the same for all domains. The http:bl Drupal module lets me enter just one honeypot path. So, if I have my a honeypot at example/honeypotscript.php, it will be one of...

example.com/example/honeypotscript.php
en.example.com/example/honeypotscript.php
de.example.com/example/honeypotscript.php

... depending on which subdomain the bot is looking at.

Your instructions seem to indicate that I should create three different scripts for the three domains, like...

example.com/example/honeypotscript.php
en.example.com/example/en.honeypotscript.php
de.example.com/example/de.honeypotscript.php

... or can I put the same script into three different places, like...

example.com/example/honeypotscript.php
en.example.com/en.example/honeypotscript.php
de.example.com/de.example/honeypotscript.php

... but the Drupal module does not let me differentiate by subdomain. Does the Drupal module need to be enhanced to provide that capability?

---------------------------------

Taking this one step further -- I find that some bots are set to visit certain adresses even though these don't exist and return "404 not found". Examples of such paths are:
node/register
admin.php

It seems only fair to give the bots something to eat ;-) and I would like to put honeypots there, so I would end up with the following honeypot addresses

example.com/example/honeypotscript.php
example.com/example/node/register
example.com/example/admin.php
en.example.com/example/honeypotscript.php
en.example.com/example/node/register
en.example.com/example/admin.php
de.example.com/example/honeypotscript.php
de.example.com/example/node/register
de.example.com/example/admin.php

(For node/register I'd probably have to store the script as node/register/index.php,)

What exactly is needed to make this work?
Could one of the 30x redirects help? Which one?
Or some .htaccess magic?
Could the script be changed to be more tolerant about where it runs, or is it already?

Thank you for your fine work with Project Honeypot!

Re: can subdomains use same php script?

Author: H.User1325 (17 May 15 11:31pm)

H.Salvisberg you are correct:

"Your instructions seem to indicate that I should create three different scripts for the three domains, like...

example.com/example/honeypotscript.php
en.example.com/example/en.honeypotscript.php
de.example.com/example/de.honeypotscript.php"

The HP scripts are sensitive about where they run, and must be run only in the domain/sub-domain in which they were requested. You can also only have one HP script in each domain/sub-domain. So bating the bots by having a HP for each of the files they try to access i.e. example/admin.php and example/register.php will not work.

On the other hand, you could have a HP at example/admin.php and then a short redirect file at example/register.php pointing to the example/admin.php HP