Upgrade to Pro — share decks privately, control downloads, hide ads and more …

DJUGL June 2013

July 17, 2013

DJUGL June 2013


July 17, 2013

Other Decks in Technology


  1. What is Blackhole? • An async “fake” MTA • Built

    on the Tornado framework • Low disk I/O (high disk I/O with debug flag enabled)
  2. Uhh... Why? • Speed testing • Integration testing • Oh

    shit I need to test on a copy of live data but can't anonymise user content and don't want to accidentally send emails to users • Honey pot (Nectar suite)
  3. Using Blackhole • Using blackhole.io service via raw SMTP or

    sending an email to <name>@blackhole.io • Running your own blackhole server just like you would Postfix, Exim etc
  4. [08A6002A19] RECV: EHLO [hel.kura.io] [08A6002A19] SEND: 250-2.5.0 OK, done [08A6002A19]

    SEND: 250-SIZE 512000 … [08A6002A19] RECV: MAIL FROM:<[email protected]> size=64 [08A6002A19] SEND: 250 2.5.0 OK, done [08A6002A19] RECV: RCPT TO:<[email protected]> [08A6002A19] SEND: 250 2.5.0 OK, done [08A6002A19] RECV: DATA [08A6002A19] SEND: 354 3.5.4 Start mail input; end with <CRLF>.<CRLF> [08A6002A19] RECV: From: <[email protected]> [08A6002A19] RECV: To: <[email protected]> [08A6002A19] RECV: Subject: Test [08A6002A19] RECV: [08A6002A19] RECV: gwergerg [08A6002A19] RECV: . [08A6002A19] SEND: 251 2.5.0 OK, done [08A6002A19] RECV: QUIT [08A6002A19] SEND: 221 2.2.1 Thank you for speaking to me
  5. PyPy • Works well with PyPy 1.9 and 2.0 •

    Performance improvements of blackhole.io of 1000% over time • Caveat: a bug somewhere that causes the process to crash on PyPy 2.0 when daemonizing... Works if daemon.start() is disabled. No clue why, need to fix.
  6. Nectar (dev/planned) • Honey pot suite, split in to 5

    components • Nectar-MTA – based on Blackhole, logs all incoming/outgoing connections + data • Nectar-SSH – Kippo-like SSH honeypot, brute force logging, fake Linux environment, shell logging • Nectar-Web – Web honeypot, exposes XSS and SQL injection vulns, logs all requests and exploit attempts • Nectar-GUI – web-based GUI for viewing and graphing data
  7. fin