{"id":1399,"date":"2025-10-18T05:00:16","date_gmt":"2025-10-18T05:00:16","guid":{"rendered":"https:\/\/help.peacedoorball.blog\/ca\/?p=1399"},"modified":"2025-10-18T05:00:16","modified_gmt":"2025-10-18T05:00:16","slug":"comment-comprendre-ce-quest-un-pot-de-miel","status":"publish","type":"post","link":"https:\/\/help.peacedoorball.blog\/ca\/comment-comprendre-ce-quest-un-pot-de-miel\/","title":{"rendered":"Comment comprendre ce qu&rsquo;est un pot de miel"},"content":{"rendered":"<p>Lorsqu&rsquo;un serveur est constamment attaqu\u00e9, surtout parce qu&rsquo;il est connect\u00e9 directement \u00e0 Internet sans aucun filtre, il est in\u00e9vitable qu&rsquo;il soit bombard\u00e9 de toutes sortes d&rsquo;erreurs automatis\u00e9es. Il ne s&rsquo;agit pas d&rsquo;attaques cibl\u00e9es, mais plut\u00f4t de robots analysant de vastes zones d&rsquo;espace IP, fouillant les ports ouverts ou testant des charges utiles al\u00e9atoires pour d\u00e9tecter des informations int\u00e9ressantes. Si vous exploitez un serveur public, qu&rsquo;il s&rsquo;agisse d&rsquo;un site web, d&rsquo;une API ou autre, vous dites \u00ab Venez me voir \u00bb \u00e0 quiconque analyse. C&rsquo;est comme \u00e7a, mais heureusement, il existe des moyens pratiques de compliquer la t\u00e2che de ces scanners al\u00e9atoires. Car bien s\u00fbr, Windows, Linux ou tout autre syst\u00e8me d&rsquo;exploitation doit rendre la t\u00e2che plus difficile que n\u00e9cessaire, n&rsquo;est-ce pas ?<\/p>\n<h2>Comment mettre en place un pot de miel basique pour pi\u00e9ger les attaquants<\/h2>\n<h3>M\u00e9thode 1 : utiliser une fausse page d&rsquo;administration ou un leurre avec un simple script honeypot<\/h3>\n<p>C&rsquo;est une m\u00e9thode simple, mais efficace pour rep\u00e9rer les scanners occasionnels ou les scripteurs novices. En r\u00e9sum\u00e9, cr\u00e9ez un faux identifiant ou un faux panneau d&rsquo;administration : rien de sp\u00e9cial, juste un r\u00e9pertoire comme <strong>\/admin<\/strong> ou <strong>\/wp-admin<\/strong>, attrayant mais sans r\u00e9elle fonction. Ensuite, configurez la journalisation de chaque adresse IP et des interactions qui tentent d&rsquo;y acc\u00e9der. Dans certaines configurations, il suffit de cr\u00e9er le r\u00e9pertoire et d&rsquo;y d\u00e9poser un script qui enregistre les adresses IP et les requ\u00eates dans un fichier ou une base de donn\u00e9es.<\/p>\n<p>Pourquoi c&rsquo;est utile : Il peut vous identifier instantan\u00e9ment qui fouille vos pages apparemment les plus sensibles. Lorsque le scanner atteint votre fausse page d&rsquo;administration, vous obtenez une adresse IP exacte, l&rsquo;heure, et peut-\u00eatre m\u00eame le nom de l&rsquo;agent utilisateur. Sur une configuration, cela a fonctionn\u00e9 du premier coup, sur une autre, il a fallu plusieurs essais, mais en g\u00e9n\u00e9ral, ces leurres sont efficaces pour intercepter les scripts automatis\u00e9s qui explorent votre site. Assurez-vous simplement que le r\u00e9pertoire n&rsquo;est pas li\u00e9 ailleurs, sinon des utilisateurs l\u00e9gitimes pourraient y acc\u00e9der par accident. Ajoutez \u00e9galement un commentaire dans votre fichier robots.txt comme \u00ab \u00bb<!-- honeypot -- >` can dissuade bots from ignoring the trap.<\/p>\n\n \n\n<p>Expect to see automated IPs getting flagging and maybe, if you want, to automatically block them with rules in your firewall or web server config. For example, if you\u2019re using Nginx, you could add something like:<\/p>\n\n \n\n<pre><code>location \/admin { # Log attempts access_log \/var\/log\/nginx\/honeypot.log; # Block after certain number of hits, or do something else } <\/code><\/pre>\n\n \n\n<p>Just keep in mind, this isn't foolproof\u2014some smarter bots might ignore the fake pages, and legit crawlers could act weird. But it\u2019s a quick way to catch the baddies or at least see who\u2019s scanning.<\/p>\n\n \n\n<h3>Method 2: Leverage robots.txt cleverly<\/h3>\n\n \n\n<p>Most websites will have a <strong>robots.txt<\/strong> file in the root folder\u2014say, `<strong>\/robots.txt<\/strong>`.You can configure it to tell bots what not to crawl, but oddly enough, many malicious bots and scanners ignore those directives and just go straight for the sensitive stuff anyway. Still, you can use this to your advantage by placing a fake or enticing filename or directory\u2014like `<strong>\/secret-admin-area<\/strong>`\u2014and tell bots to stay away (which, of course, they usually ignore).If you make this directory look juicy but is basically a trap, anyone scanning that area is probably up to no good. Logging hits here can help identify malicious actors.<\/p>\n\n \n\n<p>Why bother? Because any interaction that happens with these honeypots can be logged easily, giving insight into attacker behavior. When someone tries to access that fake admin page, you get an IP, user agent, and request details\u2014probably with no risk of affecting your real site.<\/p>\n\n \n\n<p>Pro tip: Add some fake credentials or dummy login prompts that don\u2019t do anything\u2014just enough to lure in attackers and log their details. Be cautious to ensure these decoys aren\u2019t linked from anywhere your real users might stumble onto\u2014no accidental tripping of legit visitors.<\/p>\n\n \n\n<h3>Method 3: Improve detection with interaction-based blocking<\/h3>\n\n \n\n<p>This is a step up in sophistication. Instead of just blocking anyone who hits the honeypot page, monitor if they interact further\u2014say, by submitting a form or trying to run commands. If they do, you can automatically trigger tighter restrictions or even temporarily ban them. This makes your honeypot a better tool for grabbing serious offenders rather than just catching random scans. It\u2019s kind of a fake login page with a trap\u2014pretend to be real, but log all activity and block suspicious behavior.<\/p>\n\n \n\n<p>Why it helps: Most automated attack scripts will go straight for the fake login and try to brute-force or probe further. If you record that activity, you can analyze attack patterns or block entire ranges.<\/p>\n\n \n\n<p>One practical example: create a \"login\" form at `\/admin`, but make sure it does nothing special\u2014just logs the attempt. Then, set up a script or firewall rule (like Fail2ban) to ban IPs that submit the form multiple times. This way, you\u2019re not just passively watching\u2014you\u2019re actively responding.<\/p>\n\n \n\n<h2>Wrap-up<\/h2>\n\n \n\n<p>A honeypot isn\u2019t about stopping every attack\u2014most automated scans will ignore or get confused by simple traps. But it\u2019s a good way to identify malicious IPs and slow down scripts. The real goal is to make attackers waste their time on decoys while you gather intel or block them before they cause trouble. Just be careful not to turn your honeypots into a backdoor for legit users\u2014stuff should be hidden well and not linked from anywhere public.<\/p>\n\n \n\n<p>Sometimes, a simple fake page and logging approach is enough, other times, more advanced interaction traps work better. Either way, it\u2019s better than just letting everything slide. Plus, with logs from these setups, you can improve your overall attack response.<\/p>\n\n \n\n<h2>Summary<\/h2>\n\n \n\n<ul> \n\n<li>Set up fake admin or sensitive pages to log any hits.<\/li>\n\n \n\n<li>Use robots.txt as a bait to lure scanners and log interactions.<\/li>\n\n \n\n<li>Implement interaction-based blocking for more targeted defense.<\/li>\n\n \n\n<li>Always confirm decoys aren\u2019t linked from real pages to avoid accidental banning.<\/li>\n\n <\/ul>\n\n \n\n<h2>Fingers crossed this helps<\/h2>\n\n --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Lorsqu&rsquo;un serveur est constamment attaqu\u00e9, surtout parce qu&rsquo;il est connect\u00e9 directement \u00e0 Internet sans aucun filtre, il est in\u00e9vitable qu&rsquo;il soit bombard\u00e9 de toutes sortes<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1399","post","type-post","status-publish","format-standard","hentry","category-aide"],"_links":{"self":[{"href":"https:\/\/help.peacedoorball.blog\/ca\/wp-json\/wp\/v2\/posts\/1399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/help.peacedoorball.blog\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/help.peacedoorball.blog\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/help.peacedoorball.blog\/ca\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/help.peacedoorball.blog\/ca\/wp-json\/wp\/v2\/comments?post=1399"}],"version-history":[{"count":0,"href":"https:\/\/help.peacedoorball.blog\/ca\/wp-json\/wp\/v2\/posts\/1399\/revisions"}],"wp:attachment":[{"href":"https:\/\/help.peacedoorball.blog\/ca\/wp-json\/wp\/v2\/media?parent=1399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/help.peacedoorball.blog\/ca\/wp-json\/wp\/v2\/categories?post=1399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/help.peacedoorball.blog\/ca\/wp-json\/wp\/v2\/tags?post=1399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}