Create a Honeypot Using a GT704WG Wireless Router

After having to chase some people down the street several weeks in a row for trying to crack my wireless WEP key from their cars, it occured to me that instead of viewing the popularity of my wireless network as a nuisance it could actually be an opportunity. Recently, I was fortunate enough to acquire a spare wireless GT704WG router. After tinkering around with it for a while, I found that wireless routers provide an excellent platform for delivering personalized content to would be hackers, neighbors, and anyone in the area connecting to available networks. This page provides a list of steps that I have taken to create a captive portal (a.k.a. honeypot) from my GT704WG wireless router.

License: GPL (Open Source)

Last udpated: 2010-06-13 17:10:10

Feel free to download and give it a try!

Steps

Download a telnet client such as PuTTYtel
Telnet to your router using the IP: 192.168.1.1
Run something similar to the following script at your own risk:

#! /bin/sh 
# 
# Setup wireless captive portal 
# 
# Run at your own risk, toggle the power if run you need to restore 
# @author www.CodePug.com 
  
mkdir /var/www 
mkdir /var/www/errors 
# TODO: use wget to copy your index.html into the www and errors dir 
  
# Redirect all TCP web traffic to your router's own thttpd server 
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 80 
  
# Restart the web server using our var writable directory 
kill `pidof thttpd` 
/usr/sbin/thttpd -d /var/www 
  
# Copy dproxy from the downloads section to /var 
cd /var 
wget http://www.codepug.com/downloads/dproxy 
  
# Restart the proxy server using our proxy server belwo that always  
# responds with the router's address for all requests (192.168.1.1) 
kill `pidof dproxy`;dproxy 

Useful Links

Wireless Honeypot Countermeasures (http://www.securityfocus.com/infocus/1761)
Original Router GPL Source Code

Download

The content and/or source code for the "Create a Honeypot Using a GT704WG Wireless Router" application has been made available as a reference below. It is our hope that it will be an encouragement to others learning to program other freely available applications.

Filename	Vers.	File type	Size	Comments
gt704wg-dproxySrc.zip	1.0	GPL Source Code	39k	After obtaining a mipsel toolchain, download and cross-compile this source to handle DNS.
dproxy	1.0	GLIBC 2.96 MIPSEL Binary	44k	wget http://www.codepug.com/downloads/dproxy

Note: This code has not been fully tested. Please do not run this unless you acknowledge that you assume all risks associated with its operation.