http://nepenthes.mwcollect.org/ 2008-05-10T01:41:05+01:00 http://nepenthes.mwcollect.org/ http://nepenthes.mwcollect.org/images/favicon.ico text/html 2008-04-08T04:24:42+01:00 luciano@190.55.92.164 http://nepenthes.mwcollect.org/download?do=diff&1207621482 Downloading Nepenthes Nepenthes is freely available for various distributions and as source. Download Download the source Package Sourceforge file mirror Subversion get the source svn co https://svn.mwcollect.org/nepenthes/trunk/ ... text/html 2008-02-18T17:42:17+01:00 rui@81.84.108.76 http://nepenthes.mwcollect.org/documentation:readme?do=diff&1203352937 Nepenthes Readme 1. What is Nepenthes? Nepenthes is a low interaction honeypot like honeyd or mwcollect. Low Interaction Honeypots emulate _known_ vulnerabilities to collect information about potential attacks. Nepenthes is designed to emulate ... text/html 2008-02-18T17:39:58+01:00 rui@81.84.108.76 http://nepenthes.mwcollect.org/documentation:modules:submithandler:submit_postgres?do=diff&1203352798 Submit-Postgres 1. Description Dumps the Captured files to a postgresql database, so you can track how many hits a file gets. 2. Setup create the poweruser ‘mwcollect’ createuser --createdb --login --createrole --pwprompt mw... text/html 2008-02-14T12:59:39+01:00 nepenthesdev@212.202.20.133 http://nepenthes.mwcollect.org/home?do=diff&1202990379 Nepenthes - finest collection - Welcome to the official nepenthes website! Nepenthes is a versatile tool to collect malware. It acts passively by emulating known vulnerabilities and downloading malware trying to exploit these vulnerabilities. Inte... text/html 2008-02-12T19:55:47+01:00 nepenthesdev@79.220.118.241 http://nepenthes.mwcollect.org/news_archive?do=diff&1202842547 News Archive Select a year Archived News from 2007 Archived News from 2006 Archived News from 2005 ... text/html 2008-02-12T19:55:09+01:00 nepenthesdev@79.220.118.241 http://nepenthes.mwcollect.org/news_archive:2007?do=diff&1202842509 Nepenthes News Archive for 2006 July 23rd 2007 sqlslammer - a golden oldie While evaluating the problems of shellcode emulation providing proxied api hooks, we came to the conclusion it might be damn dangerous as one could write shellcode w... text/html 2008-02-12T19:42:17+01:00 nepenthesdev@79.220.118.241 http://nepenthes.mwcollect.org/news_archive:2006?do=diff&1202841737 Nepenthes News Archive for 2006 December 30th 2006 Whats left to say looking back Somewhen in the end of 2005 http://www.surfnet.nl SurfNET asked us for a way to parse nepenthes logfiles to store the information in a database, today they... text/html 2007-12-02T22:06:07+01:00 rui@81.84.108.101 http://nepenthes.mwcollect.org/howto:reversing_windows32_shellcodes?do=diff&1196629567 Analyzing shellcode With Nepenthes you’ll get a lot of known malware, but depending on the range you listen on you might get even more unknown stuff. Unknown and new stuff needs to be analyzed in order to collect it automatically in the fut... text/html 2007-07-17T16:14:07+01:00 nepenthesdev@212.202.20.153 http://nepenthes.mwcollect.org/cnsi:function_hashes?do=diff&1184681647 Function hashing in shellcodes Hashing code uint32_t hash_by(void *key, uint8_t num) { uint32_t hash = 0; char *c = (char *)key;   while (*c != 0) { hash = hash << (32-num) | hash >&g... text/html 2007-07-15T15:27:17+01:00 nepenthesdev@212.202.20.153 http://nepenthes.mwcollect.org/csni?do=diff&1184506037 Common Shellcode Naming Initiative CSNI ? Read this new place for more information function_hashes todo Shellcodes Names by CSNI Name/Codename Type comment adenau bindshell - alsfeld base64 decoded createprocess file missing a... text/html 2007-06-06T13:20:43+01:00 nepenthesdev@212.202.20.59 http://nepenthes.mwcollect.org/navigation?do=diff&1181128843 nepenthes /download Download /documentation Documentation https://sourceforge.net/mail/?group_id=137598 Mailing-Lists Development http://svn.mwcollect.org/report/9 Bugs /development Subversion https://sourceforge.net/tracker/?group_id=137598&atid... text/html 2007-04-01T14:39:36+01:00 nepenthesdev@212.202.20.197 http://nepenthes.mwcollect.org/papers_and_news?do=diff&1175431176 Papers shellcode emulation Advanced Computer Networks Polymorphic Shellcode (Detection) papers_and_news:advanced_computer_networks-polymorphic_shellcode_detection_2006_gratl.pdf by Christoph Gratl Analyzing Network Traffic To Detect Self... text/html 2006-11-22T12:08:52+01:00 nepenthesdev@212.202.20.69 http://nepenthes.mwcollect.org/contrib:signingpatches?do=diff&1164193732 Signing patches As we want to make sure we can grant a intrested party a license on the code which offers them more than the GPL license, we need your acknowledgement on this before we can adopt patches you might send in. In short, this means, you... text/html 2006-11-13T21:17:40+01:00 nepenthesdev@212.202.20.69 http://nepenthes.mwcollect.org/documentation:modules:other:module-honeytrap?do=diff&1163449060 module-honeytrap 1. Description module-honeytrap is a appraoch using the honeytrap idea by Tillmann Werner in nepenthes. It can run in three modes, pcap (should be generic), ipq (linux specific) and ipfw divert sockets (freebsd specific, mayb... text/html 2006-08-25T18:12:03+01:00 oxff@12.40.142.234 http://nepenthes.mwcollect.org/documentation:modules:submithandler:submit_postgres:schema?do=diff&1156522323 this may change -- -- PostgreSQL database dump --   SET client_encoding = 'UTF8'; SET check_function_bodies = false; SET client_min_messages = warning;   -- -- Name: ip2location; Type: SCHEMA; Schema: -; Owner: mwcollect --   CREATE S... text/html 2006-08-16T19:31:51+01:00 oxff@80.133.23.247 http://nepenthes.mwcollect.org/development?do=diff&1155749511 Development Subversion repository The subversion repository is public, you can access it by using the subversion client: https://svn.mwcollect.org/nepenthes/trunk or browse it online via trac: http://svn.mwcollect.org/browser/nepenthes/trunk... text/html 2006-07-29T21:14:48+01:00 nepenthesdev@84.178.227.102 http://nepenthes.mwcollect.org/contact?do=diff&1154200488 Contact handle mail Developer Nepenthes Development Team Submission Coordination Stargazer samples@stargazer.at ... text/html 2006-07-24T11:53:48+01:00 stargazer@62.218.123.21 http://nepenthes.mwcollect.org/partner?do=diff&1153734828 Partner What is a partner? Partner companies are either companies that are accepting mass submissions of malware or supporting the nepenthes team in some way (donations, information,...) Cooperating AV labs receiving malware submissions ... text/html 2006-07-17T11:50:06+01:00 oxff@193.55.113.196 http://nepenthes.mwcollect.org/gotek_2.0_draft?do=diff&1153129806 G.O.T.E.K. Malware Distribution Protocol This file describes the in development version of the G.O.T.E.K. malware distribution protocol. Protocol Design The G.O.T.E.K protocol was initially designed for streaming malware binaries to a central... text/html 2006-05-18T04:29:55+01:00 nepenthesdev@212.202.23.48 http://nepenthes.mwcollect.org/documentation:modules:shellcode-signatures?do=diff&1147919395 shellcode signatures format <namespace>::##name## { pattern " the pcre " " "; mapping (map,values); }; Namespaces xor this namespaces allows unxoring xor encrypted data an example xor::example &#12...