Honeypots mailing list archives

what to do with a script kiddie


From: carnack <carnack () gmx net>
Date: Sat, 4 Jun 2005 10:44:33 +0200

Hi,
I was operating my honeynet successfully over some days. I "catched" an intruder and monitored him closely for about 11 days. He was not very skilled, the term "script kiddy" fits the bill. I got some IPs of his copromised attack hosts and a lot of his passwords, for example his CSERVICE IRC password. I wonder what to do with that information now, as the intention of my study was my diploma thesis. Should I "snatch" his IRC channels and expose him? What have you done after getting such information? I am really interested in your experiences.
yours
Christian

P.S. roo is a breeze!


Current thread: