Adel Karimi
Adel Karimi is a senior security engineer with a keen interest in threat detection, honeypots, and network traffic fingerprinting. He recently joined a “chatbot startup” after a decade of working on detection and response at companies such as Google, Salesforce, and Niantic. Adel is passionate about developing open-source projects like Galah and Venator, and in his free time, he enjoys capturing stunning images of the night sky.
Session
Honeypots are invaluable tools for monitoring internet-wide scans and understanding attackers' techniques. Traditional low-interaction web honeypots use manual methods to emulate various applications or vulnerabilities. Introducing Galah, an LLM-powered web honeypot that mimics diverse applications with a single prompt. This honeypot dynamically crafts relevant HTTP responses, including headers and body content, to various HTTP requests, effectively simulating multiple web applications. In this talk, I will share lessons learned from building and deploying Galah and address two key questions: How do different large language models perform in generating HTTP messages? Does delivering authentic-looking HTTP responses increase attackers’ engagement with the honeypot?