From the Archive: A Trap System Against Web-Based Cyber Attacks (2017)

The other day, while rummaging through some old boxes, a magazine turned up: Uluslararası Siber Güvenlik Federasyonu Dergisi (the International Cyber Security Federation's journal), Issue 2, November 2017. On page 92 sits my article — "Web Tabanlı Siber Saldırılara Karşı Tuzak Sistemi" ("A Trap System Against Web-Based Cyber Attacks").

It grew out of my undergraduate graduation thesis in Computer Engineering at Fırat University. I had just graduated, and I had turned the system I built for the thesis into a journal article. Today honeypots and deception technology are a standard part of the enterprise security vocabulary — but in 2017, especially in Türkiye, not many people were building this as a working model.

The Idea: Sending the Attacker Through the Wrong Door

The honeypot logic is simple: deliberately turn part of your servers into a trap and keep the attacker away from the truly valuable data.

So I wrote a sample banking system on virtual machines and split it in two. The trap zone was full of deliberate vulnerabilities and only worked with worthless data, like the website's text content. The secure zone, on the other hand, held account details, credit cards, cheques and promissory notes — and there wasn't a single hole in it.

While the attacker was kept busy in the trap zone, the real data was never at risk.

The Bait: Deliberately Planted Holes

The crux of the project was the vulnerabilities I wanted the attacker to find. They had to be visible enough for the trap to work. Here's the snippet published in the journal as Figure 1.1:

$title = $_GET["title"];
$sql = "SELECT * FROM news WHERE title LIKE '%" . $title . "%'";
$recordset = mysqli_query($link, $sql);

The input is pasted straight into the query; adding a single quote at the end is enough for an injection. Next to it I added an unchecked include, which made it possible to reach files on the server with a request like ?sayfa=../../../etc/passwd.

On the attack side, you could use sqlmap or just try URLs by hand. I still like the note I made in the article: "the only difference between the two is time."

The Trap's Alarm

Setting a trap isn't enough — you have to notice the attack. For that, I took Scalp Log Analyzer, modified it to fit my needs and translated it into Turkish. It scanned the Apache logs against a rules file and separated attack packets from normal traffic.

First I ran it with no attacks at all: 0 attacks. Then I exploited the holes I had left myself and ran it again: 7 lines processed, 2 attacks caught, output generated, notification sent.

In the final step I automated the analysis with a CronJob: the system scanned itself and, when it found an attack, sent the server administrator a detailed email. IP address, connection packets, browser information — we had it all.

Nine Years Later

The idea still holds; what has changed is what we have at hand to do the same job today.

Password storage has moved from md5() to password_hash() and Argon2id. The log scanner I wrote by hand has been replaced by real-time detection and automated response tools like Fail2ban, CrowdSec and Wazuh. You don't need to write a honeypot from scratch anymore either — T-Pot, Cowrie and OpenCanary are ready and waiting. And those four virtual machine setups that took me days are now a single docker-compose.yml file.

But what makes me smile most is this: hooking the analysis up to a CronJob and having it email the administrator automatically was really nothing more than a handmade version of what we now call "continuous monitoring and automated alerting".

The Part That Hasn't Changed

On the technology side, almost everything has changed. But the article's core thesis still stands:

You can't stop attacks completely; but you can control where the attacker looks and see what's going on.

Moving valuable data into a separate zone, drawing the attacker's attention to a low-value surface, logging every access and analysing those logs automatically. Today we call these defense in depth, deception technology, detection engineering. The names have changed; the idea is the same idea.

And the fact that a freshly graduated computer engineering student built this on his own and wrote it up for a journal is, looking back, something I'm still proud of.

Original Journal Pages

Do you have a project like this "from the archive"? If there's something you made years ago that you still stand behind when you look back at it, tell me about it in the comments — I'd love to read it.

Happy coding!