In this demo we will install KFSensor, which is a honeypot application.
Now, honeypot application KFSensor
can work with or without packet capturing technology.
If you need the packet capturing feature to be enabled,
then you need to install either WinPcap or Npcap.
However, KFSensor always prefers to use Npcap over WinPcap
because of its updated code base.
So let's first install Npcap, post which we will install KFSensor.
User Account Control dialog box, say Yes to proceed.
Click Yes to proceed.
The Npcap Setup Wizard is now displayed.
On the license agreement page, click I Agree.
On the installation options page, click Install.
The installing page is displayed,
this will show the installation progress of Npcap.
If you want to see the detail of Npcap,
then you can just click on the Show details button.
The installation takes a few minutes.
Post this installation, we will proceed with the installation of KFSensor.
After the installation is completed, click Next.
On the finished page, click Finish.
Now, we have installed Npcap, which is a packet capturing application.
Double-click on the kfsense40 executable.
Windows Installer dialog box is displayed now.
So it's preparing to install the application.
KFSensor Evaluation Setup Wizard is displayed on the Welcome page, click Next.
On the End-User License Agreement page,
click I accept the terms in the License Agreement, click Next.
On the Destination Folder page,
keep the default installation path, and click Next.
On the Ready to install KFSensor Evaluation, click Install.
It's a pretty straightforward installation,
there are no complications in the installation, as it is GUI based.
Once it is installed, then we'll be able to use KFSensor.
So User Account Control dialog box is displayed, click Yes.
Now the installation progress is displayed.
The installation doesn't take much time, it's only a few minutes job.
Once it is installed, we'll be able to use the application.
Notice that it's now showing Starting services, the installation is done.
It's now starting the services.
Keep Launch KFSensor option selected.
On the completed page, click Finish.
You're done with the installation of KFSensor,
which is a honeypot application.
Okay, so it's not able to locate WinPcap.
So, network protocol analyzer functionality will now be disabled,
so which is okay.
For this demo we don't really need it.
So notice that there is some bit of traffic on different ports,
which is fine, this traffic is okay.
There's nothing to worry about.
Just remember one thing, honeypot is not designed to send or receive traffic.
So if there is any traffic that is directed towards the honeypot,
you should analyze that traffic.
So this is now configured.
This is my host system on which this virtual machine has been set up.
So this is fine, this is the VMware applications DHCP server,
so there is no suspicion on this traffic.
So let's see if there is some bit of traffic that we can generate,
Split up the default homepage.
So what I've done is from my host system,
I've connected to the IIS website running on 3128 port.
Notice that it's already started to
pick up the alarms that somebody is already connected.
So this is a typical role that a honeypot plays.
Anybody who is trying to connect to any of the ports
that are available on this honeypot, it's going to capture that traffic.
Now, the benefit of this is now you can find out
which is the visitor and what type of request is being received.
This is what needs to be analyzed.
So that's it for this demo.