{"id":281,"date":"2013-04-30T23:00:36","date_gmt":"2013-04-30T22:00:36","guid":{"rendered":"http:\/\/kbyte.snowpenguin.org\/portal\/?p=281"},"modified":"2020-09-27T00:39:40","modified_gmt":"2020-09-26T22:39:40","slug":"kippo-protocol-mismatch-workaround","status":"publish","type":"post","link":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/","title":{"rendered":"Kippo: &#8220;Protocol mismatch&#8221; workaround"},"content":{"rendered":"\n<p>Un honeypot a bassa interazione, come <a href=\"https:\/\/code.google.com\/p\/kippo\/\" target=\"_blank\" rel=\"noopener noreferrer\">Kippo<\/a>, deve cercare di riprodurre ogni caratteristica del servizio che cerca di emulare. Errori compresi. Purtroppo non sempre ci\u00f2 \u00e8 possibile, il che rende la trappola rilevabile da umani e programmi che scansionano automaticamente i servizi presenti su una macchina.<\/p>\n\n\n\n<p>Kippo usa il modulo &#8220;conch&#8221; di <a href=\"http:\/\/twistedmatrix.com\/trac\/\" target=\"_blank\" rel=\"noopener noreferrer\">Twisted<\/a>&nbsp;che in alcune occasioni non si comporta come un comune server OpenSSH. Ad esempio, &nbsp;se ad inizio della connessione la richiesta \u00e8 malformata, il server risponde con un triste:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\"><p>[bytesvari] bad packet length [bytesvari]<\/p><\/blockquote>\n\n\n\n<p>Mentre il messaggio di errore che l&#8217;utente dovrebbe ricevere solamente:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\"><p>Protocol mismatch.<\/p><\/blockquote>\n\n\n\n<p>Ma non abbiate timori di essere scoperti con questo trucco meschino! Baster\u00e0 utilizzare questa semplice patch per far si di intercettare e modificare il messaggio di risposta per renderlo conforme a quello standard.<\/p>\n\n\n\n<p><a href=\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/kippo-r246-bpl-patch\/\" rel=\"attachment wp-att-283\">kippo-r246-bpl.patch<br><\/a><a href=\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/kippo-0-8-bpl-patch\/\" rel=\"attachment wp-att-282\">kippo-0.8-bpl.patch<\/a><\/p>\n\n\n\n<p>Buona caccia!<\/p>\n\n\n\n<figure class=\"wp-block-embed-youtube wp-block-embed is-type-video is-provider-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"World&#039;s worst hacker\" width=\"640\" height=\"360\" src=\"https:\/\/www.youtube.com\/embed\/oJagxe-Gvpw?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Un honeypot a bassa interazione, come Kippo, deve cercare di riprodurre ogni caratteristica del servizio che cerca di emulare. Errori compresi. Purtroppo non sempre ci\u00f2 \u00e8 possibile, il che rende la trappola rilevabile da umani e programmi che scansionano automaticamente i servizi presenti su una macchina. Kippo usa il modulo &#8220;conch&#8221; di Twisted&nbsp;che in alcune [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[37,36,39,38],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Kippo: &quot;Protocol mismatch&quot; workaround - Kbyte@Snowpenguin<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kippo: &quot;Protocol mismatch&quot; workaround - Kbyte@Snowpenguin\" \/>\n<meta property=\"og:description\" content=\"Un honeypot a bassa interazione, come Kippo, deve cercare di riprodurre ogni caratteristica del servizio che cerca di emulare. Errori compresi. Purtroppo non sempre ci\u00f2 \u00e8 possibile, il che rende la trappola rilevabile da umani e programmi che scansionano automaticamente i servizi presenti su una macchina. Kippo usa il modulo &#8220;conch&#8221; di Twisted&nbsp;che in alcune [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/\" \/>\n<meta property=\"og:site_name\" content=\"Kbyte@Snowpenguin\" \/>\n<meta property=\"article:published_time\" content=\"2013-04-30T22:00:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-09-26T22:39:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kbyte.snowpenguin.org\/blog\/wp-content\/uploads\/2014\/11\/snowpenguin-blogo.png\" \/>\n\t<meta property=\"og:image:width\" content=\"150\" \/>\n\t<meta property=\"og:image:height\" content=\"150\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Kbyte\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@kbytesys\" \/>\n<meta name=\"twitter:site\" content=\"@kbytesys\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kbyte\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minuto\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/\"},\"author\":{\"name\":\"Kbyte\",\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/f3113c5247622ffcdd4e830ed842a7e4\"},\"headline\":\"Kippo: &#8220;Protocol mismatch&#8221; workaround\",\"datePublished\":\"2013-04-30T22:00:36+00:00\",\"dateModified\":\"2020-09-26T22:39:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/\"},\"wordCount\":151,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/f3113c5247622ffcdd4e830ed842a7e4\"},\"keywords\":[\"honeypot\",\"kippo\",\"patch\",\"security\"],\"articleSection\":[\"Articoli\"],\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/\",\"url\":\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/\",\"name\":\"Kippo: \\\"Protocol mismatch\\\" workaround - Kbyte@Snowpenguin\",\"isPartOf\":{\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/#website\"},\"datePublished\":\"2013-04-30T22:00:36+00:00\",\"dateModified\":\"2020-09-26T22:39:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/kbyte.snowpenguin.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kippo: &#8220;Protocol mismatch&#8221; workaround\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/#website\",\"url\":\"https:\/\/kbyte.snowpenguin.org\/blog\/\",\"name\":\"Kbyte@Snowpenguin\",\"description\":\"The inner conflict of a fullstack dev\",\"publisher\":{\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/f3113c5247622ffcdd4e830ed842a7e4\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/kbyte.snowpenguin.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/f3113c5247622ffcdd4e830ed842a7e4\",\"name\":\"Kbyte\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7e0ebb5f55788dd3f5e14739d348876a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7e0ebb5f55788dd3f5e14739d348876a?s=96&d=mm&r=g\",\"caption\":\"Kbyte\"},\"logo\":{\"@id\":\"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/image\/\"},\"url\":\"https:\/\/kbyte.snowpenguin.org\/blog\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Kippo: \"Protocol mismatch\" workaround - Kbyte@Snowpenguin","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/","og_locale":"it_IT","og_type":"article","og_title":"Kippo: \"Protocol mismatch\" workaround - Kbyte@Snowpenguin","og_description":"Un honeypot a bassa interazione, come Kippo, deve cercare di riprodurre ogni caratteristica del servizio che cerca di emulare. Errori compresi. Purtroppo non sempre ci\u00f2 \u00e8 possibile, il che rende la trappola rilevabile da umani e programmi che scansionano automaticamente i servizi presenti su una macchina. Kippo usa il modulo &#8220;conch&#8221; di Twisted&nbsp;che in alcune [&hellip;]","og_url":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/","og_site_name":"Kbyte@Snowpenguin","article_published_time":"2013-04-30T22:00:36+00:00","article_modified_time":"2020-09-26T22:39:40+00:00","og_image":[{"width":150,"height":150,"url":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-content\/uploads\/2014\/11\/snowpenguin-blogo.png","type":"image\/png"}],"author":"Kbyte","twitter_card":"summary_large_image","twitter_creator":"@kbytesys","twitter_site":"@kbytesys","twitter_misc":{"Scritto da":"Kbyte","Tempo di lettura stimato":"1 minuto"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/#article","isPartOf":{"@id":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/"},"author":{"name":"Kbyte","@id":"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/f3113c5247622ffcdd4e830ed842a7e4"},"headline":"Kippo: &#8220;Protocol mismatch&#8221; workaround","datePublished":"2013-04-30T22:00:36+00:00","dateModified":"2020-09-26T22:39:40+00:00","mainEntityOfPage":{"@id":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/"},"wordCount":151,"commentCount":0,"publisher":{"@id":"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/f3113c5247622ffcdd4e830ed842a7e4"},"keywords":["honeypot","kippo","patch","security"],"articleSection":["Articoli"],"inLanguage":"it-IT","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/","url":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/","name":"Kippo: \"Protocol mismatch\" workaround - Kbyte@Snowpenguin","isPartOf":{"@id":"https:\/\/kbyte.snowpenguin.org\/blog\/#website"},"datePublished":"2013-04-30T22:00:36+00:00","dateModified":"2020-09-26T22:39:40+00:00","breadcrumb":{"@id":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/kbyte.snowpenguin.org\/blog\/2013\/04\/30\/kippo-protocol-mismatch-workaround\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kbyte.snowpenguin.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Kippo: &#8220;Protocol mismatch&#8221; workaround"}]},{"@type":"WebSite","@id":"https:\/\/kbyte.snowpenguin.org\/blog\/#website","url":"https:\/\/kbyte.snowpenguin.org\/blog\/","name":"Kbyte@Snowpenguin","description":"The inner conflict of a fullstack dev","publisher":{"@id":"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/f3113c5247622ffcdd4e830ed842a7e4"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kbyte.snowpenguin.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":["Person","Organization"],"@id":"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/f3113c5247622ffcdd4e830ed842a7e4","name":"Kbyte","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/7e0ebb5f55788dd3f5e14739d348876a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7e0ebb5f55788dd3f5e14739d348876a?s=96&d=mm&r=g","caption":"Kbyte"},"logo":{"@id":"https:\/\/kbyte.snowpenguin.org\/blog\/#\/schema\/person\/image\/"},"url":"https:\/\/kbyte.snowpenguin.org\/blog\/author\/admin\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/posts\/281"}],"collection":[{"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/comments?post=281"}],"version-history":[{"count":15,"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/posts\/281\/revisions"}],"predecessor-version":[{"id":862,"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/posts\/281\/revisions\/862"}],"wp:attachment":[{"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/media?parent=281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/categories?post=281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kbyte.snowpenguin.org\/blog\/wp-json\/wp\/v2\/tags?post=281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}