Web Application Defender's Cookbook

Honeytrap Concepts

The honeytrap concept is rather simple: It is essentially a booby trap that is built into the application. Whereas honeypot systems are separate hosts that you deploy within your network to act as targets, honeytraps are planted throughout a web application and act as a virtual minefield for would-be attackers. They have no valid production purpose, and no interaction with or alteration of them has been authorized, so any interaction is most assuredly suspicious.

A honeytrap’s true value lies in being able to quickly distinguish malicious users from benign users. Honeytraps function as trip wires during various phases of attack. Before an attacker can launch a malicious request, he must conduct some reconnaissance on the application to understand its layout, construction, and technologies in use. He must find out how the application handles authentication, authorization, session management, and input validation. It is during these initial reconnaissance-gathering stages that honeytraps can easily spot users with malicious intent when they attempt to manipulate the data. Honeytrap concepts are simple yet effective.

Let’s take a closer look at the three main benefits of using honeytraps:

• High-fidelity alerts. Because all honeytrap activity is, by definition, unauthorized, it is extremely effective at reducing false-positive alerts.
• A smaller number of alerts. A honeytrap generates alerts only when a client either interacts with or manipulates it. This results ...