{"id":24,"date":"2025-12-09T18:19:17","date_gmt":"2025-12-09T15:19:17","guid":{"rendered":"https:\/\/www.sezgineren.com\/Blog\/?p=24"},"modified":"2025-12-15T13:48:16","modified_gmt":"2025-12-15T10:48:16","slug":"honeypot-bal-kupu-siber-saldirganlari-tuzaga-dusuren-guvenlik-teknigi","status":"publish","type":"post","link":"https:\/\/www.sezgineren.com\/Blog\/honeypot-bal-kupu-siber-saldirganlari-tuzaga-dusuren-guvenlik-teknigi","title":{"rendered":"Honeypot (Bal K\u00fcp\u00fc): Siber Sald\u0131rganlar\u0131 Tuza\u011fa D\u00fc\u015f\u00fcren G\u00fcvenlik Tekni\u011fi"},"content":{"rendered":"<p data-path-to-node=\"4\">Siber g\u00fcvenlik d\u00fcnyas\u0131nda sald\u0131rganlar genellikle avc\u0131, sistemler ise av konumundad\u0131r. Peki ya rolleri de\u011fi\u015ftirip sald\u0131rgan\u0131 avlasayd\u0131k? \u0130\u015fte <b>Honeypot (Bal K\u00fcp\u00fc)<\/b> tekni\u011fi tam olarak burada devreye giriyor.<\/p>\n<p data-path-to-node=\"5\">\u0130sminden de anla\u015f\u0131laca\u011f\u0131 \u00fczere bu teknik, &#8220;ay\u0131lar\u0131 \u00e7ekmek i\u00e7in bal dolu bir k\u00fcp b\u0131rakma&#8221; mant\u0131\u011f\u0131na dayan\u0131r. Ancak buradaki ay\u0131lar siber korsanlar (hackerlar), bal ise savunmas\u0131z g\u00f6r\u00fcnen ama asl\u0131nda birer tuzak olan sistemlerdir.<\/p>\n<p data-path-to-node=\"6\">Bu yaz\u0131m\u0131zda, siber savunman\u0131n en proaktif y\u00f6ntemlerinden biri olan Honeypot&#8217;un ne oldu\u011funu, nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 ve t\u00fcrlerini inceleyece\u011fiz.<\/p>\n<h2 data-path-to-node=\"7\">Honeypot Nedir?<\/h2>\n<p data-path-to-node=\"8\"><b>Honeypot<\/b>, siber sald\u0131rganlar\u0131 cezbetmek, tespit etmek ve analiz etmek i\u00e7in kas\u0131tl\u0131 olarak tehlikeye a\u00e7\u0131km\u0131\u015f gibi g\u00f6sterilen bir tuzak sistemdir.<\/p>\n<p data-path-to-node=\"9\">Bu sistemler, ger\u00e7ek \u00fcretim sunucular\u0131n\u0131 veya veritabanlar\u0131n\u0131 taklit eder ancak i\u00e7inde ger\u00e7ek bir veri bar\u0131nd\u0131rmazlar. Bir sald\u0131rgan honeypot&#8217;a s\u0131zd\u0131\u011f\u0131nda, asl\u0131nda de\u011ferli bir veriye ula\u015fmaz; aksine kendi y\u00f6ntemlerini, IP adresini ve sald\u0131r\u0131 imzas\u0131n\u0131 g\u00fcvenlik uzmanlar\u0131na if\u015fa etmi\u015f olur.<\/p>\n<blockquote data-path-to-node=\"10\">\n<p data-path-to-node=\"10,0\"><b>\u00d6nemli Not:<\/b> Honeypot sistemlerine me\u015fru (normal) bir kullan\u0131c\u0131n\u0131n girmesi i\u00e7in hi\u00e7bir sebep yoktur. Bu nedenle, bir honeypot ile kurulan herhangi bir etkile\u015fim, varsay\u0131lan olarak &#8220;\u015f\u00fcpheli&#8221; veya &#8220;k\u00f6t\u00fc niyetli&#8221; kabul edilir.<\/p>\n<\/blockquote>\n<h2 data-path-to-node=\"11\">Honeypot Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h2>\n<p data-path-to-node=\"12\">Honeypot&#8217;un \u00e7al\u0131\u015fma prensibi olduk\u00e7a basittir ancak arkas\u0131ndaki m\u00fchendislik karma\u015f\u0131kt\u0131r:<\/p>\n<ol start=\"1\" data-path-to-node=\"13\">\n<li>\n<p data-path-to-node=\"13,0,0\"><b>Yemleme:<\/b> A\u011f \u00fczerinde savunmas\u0131z g\u00f6r\u00fcnen bir sunucu, uygulama veya veritaban\u0131 olu\u015fturulur (\u00d6rn: Basit \u015fifreli bir SSH portu veya g\u00fcncellenmemi\u015f bir veritaban\u0131).<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"13,1,0\"><b>\u0130zolasyon:<\/b> Bu sistem, ger\u00e7ek a\u011fdan izole edilir. B\u00f6ylece sald\u0131rgan tuza\u011fa d\u00fc\u015ft\u00fc\u011f\u00fcnde ana sistemlere s\u0131\u00e7rayamaz.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"13,2,0\"><b>\u0130zleme ve Loglama:<\/b> Sald\u0131rgan sisteme girdi\u011fi andan itibaren her tu\u015f darbesi, denedi\u011fi komutlar ve y\u00fckledi\u011fi dosyalar kaydedilir.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"13,3,0\"><b>Analiz:<\/b> Toplanan veriler incelenerek sald\u0131rgan\u0131n kimli\u011fi, kulland\u0131\u011f\u0131 teknikler ve g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131z hakk\u0131nda bilgi edinilir.<\/p>\n<\/li>\n<\/ol>\n<h2 data-path-to-node=\"14\">Honeypot T\u00fcrleri Nelerdir?<\/h2>\n<p data-path-to-node=\"15\">Kullan\u0131m ama\u00e7lar\u0131na ve karma\u015f\u0131kl\u0131k seviyelerine g\u00f6re honeypotlar iki ana kategoriye ayr\u0131l\u0131r:<\/p>\n<h3 data-path-to-node=\"16\">1. Ama\u00e7lar\u0131na G\u00f6re<\/h3>\n<ul data-path-to-node=\"17\">\n<li>\n<p data-path-to-node=\"17,0,0\"><b>\u00dcretim (Production) Honeypotlar\u0131:<\/b> \u015eirketlerin kendi a\u011flar\u0131n\u0131 korumak i\u00e7in kurduklar\u0131 sistemlerdir. Genellikle kurulumu daha basittir ve as\u0131l ama\u00e7 sald\u0131r\u0131y\u0131 tespit edip alarm vermektir.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"17,1,0\"><b>Ara\u015ft\u0131rma (Research) Honeypotlar\u0131:<\/b> G\u00fcvenlik firmalar\u0131, \u00fcniversiteler veya devlet kurumlar\u0131 taraf\u0131ndan kullan\u0131l\u0131r. Ama\u00e7 korumadan ziyade, yeni vir\u00fcs t\u00fcrlerini ke\u015ffetmek ve hacker psikolojisini analiz etmektir.<\/p>\n<\/li>\n<\/ul>\n<h3 data-path-to-node=\"18\">2. Etkile\u015fim Seviyesine G\u00f6re<\/h3>\n<ul data-path-to-node=\"19\">\n<li>\n<p data-path-to-node=\"19,0,0\"><b>D\u00fc\u015f\u00fck Etkile\u015fimli (Low-Interaction):<\/b> Ger\u00e7ek bir i\u015fletim sistemi sunmaz, sadece belirli servisleri (\u00f6rn: FTP, Telnet) sim\u00fcle eder. Sald\u0131rgan sistemin sahte oldu\u011funu \u00e7abuk anlayabilir ancak riski d\u00fc\u015f\u00fckt\u00fcr.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"19,1,0\"><b>Y\u00fcksek Etkile\u015fimli (High-Interaction):<\/b> Ger\u00e7ek bir i\u015fletim sistemi ve ger\u00e7ek savunmas\u0131z uygulamalar bar\u0131nd\u0131r\u0131r. Sald\u0131rgan sistemin i\u00e7inde diledi\u011fi gibi hareket edebilir. \u00c7ok detayl\u0131 veri sa\u011flar ancak &#8220;Hacklenen sistemin ba\u015fka sistemlere sald\u0131rmak i\u00e7in kullan\u0131lmas\u0131&#8221; riski ta\u015f\u0131r.<\/p>\n<\/li>\n<\/ul>\n<h2 data-path-to-node=\"20\">Neden Honeypot Kullanmal\u0131s\u0131n\u0131z? (Avantajlar\u0131)<\/h2>\n<ul data-path-to-node=\"21\">\n<li>\n<p data-path-to-node=\"21,0,0\"><b>D\u00fc\u015f\u00fck Yanl\u0131\u015f Pozitif (False Positive) Oran\u0131:<\/b> G\u00fcvenlik duvarlar\u0131 bazen normal trafi\u011fi de engelleyebilir. Ancak honeypot&#8217;a gelen trafik %99 ihtimalle sald\u0131r\u0131d\u0131r.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"21,1,0\"><b>Sald\u0131rgan\u0131 Oyalama:<\/b> Hacker, sahte sistemle u\u011fra\u015f\u0131rken zaman kaybeder ve bu s\u0131rada ger\u00e7ek sistemleriniz g\u00fcvende kal\u0131r.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"21,2,0\"><b>\u0130stihbarat Toplama:<\/b> Sald\u0131rgan\u0131n \u015firketinize \u00f6zel mi geldi\u011fi, yoksa rastgele tarama m\u0131 yapt\u0131\u011f\u0131 anla\u015f\u0131l\u0131r.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"21,3,0\"><b>\u015eifrelenmi\u015f Trafi\u011fi Yakalama:<\/b> Sald\u0131rgan \u015fifreli bir kanal (SSH, HTTPS) kullansa bile, honeypot sunucusu \u015fifre \u00e7\u00f6z\u00fcc\u00fc anahtara sahip oldu\u011fu i\u00e7in trafi\u011fi d\u00fcz metin olarak okuyabilir.<\/p>\n<\/li>\n<\/ul>\n<h2 data-path-to-node=\"22\">Riskleri Var m\u0131?<\/h2>\n<p data-path-to-node=\"23\">Evet, do\u011fru yap\u0131land\u0131r\u0131lmam\u0131\u015f bir y\u00fcksek etkile\u015fimli honeypot, sald\u0131rgan taraf\u0131ndan ele ge\u00e7irilip di\u011fer a\u011flara sald\u0131rmak i\u00e7in bir &#8220;z\u0131plama tahtas\u0131&#8221; (jump server) olarak kullan\u0131labilir. Bu y\u00fczden honeypotlar\u0131n <b>DMZ (Demilitarized Zone)<\/b> i\u00e7inde ve s\u0131k\u0131 bir izolasyonla tutulmas\u0131 \u015fartt\u0131r.<\/p>\n<h2 data-path-to-node=\"24\">Sonu\u00e7<\/h2>\n<p data-path-to-node=\"25\">Honeypot, siber g\u00fcvenlik stratejinizde &#8220;pasif savunma&#8221;dan &#8220;aktif savunma&#8221;ya ge\u00e7i\u015fin anahtar\u0131d\u0131r. Sadece sald\u0131r\u0131lar\u0131 engellemekle kalmaz, ayn\u0131 zamanda d\u00fc\u015fman\u0131n\u0131z\u0131 tan\u0131man\u0131z\u0131 sa\u011flar. Unutmay\u0131n, d\u00fc\u015fman\u0131n\u0131 tan\u0131yan bir savunmac\u0131, her zaman bir ad\u0131m \u00f6ndedir.<\/p>\n<hr>\n\t\t<p>Youtube Kanal\u0131ma Abone Olun : <a target=\"_blank\" href=\"https:\/\/www.youtube.com\/@SezginEren\">https:\/\/www.youtube.com\/@SezginEren<\/a><\/p>\n\t\t<p><a target=\"_blank\" href=\"https:\/\/www.sezgineren.com\/GorusmeTalebi.aspx\"><img decoding=\"async\" src=\"https:\/\/www.sezgineren.com\/assets\/img\/sezgineren_blog.png\" \/><\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Siber g\u00fcvenlik d\u00fcnyas\u0131nda sald\u0131rganlar genellikle avc\u0131, sistemler ise av konumundad\u0131r. Peki ya rolleri de\u011fi\u015ftirip sald\u0131rgan\u0131 avlasayd\u0131k? \u0130\u015fte Honeypot (Bal K\u00fcp\u00fc) tekni\u011fi tam olarak burada devreye giriyor. \u0130sminden de anla\u015f\u0131laca\u011f\u0131 \u00fczere bu teknik, &#8220;ay\u0131lar\u0131 \u00e7ekmek i\u00e7in bal dolu bir k\u00fcp b\u0131rakma&#8221; mant\u0131\u011f\u0131na dayan\u0131r. Ancak buradaki ay\u0131lar siber korsanlar (hackerlar), bal ise savunmas\u0131z g\u00f6r\u00fcnen ama asl\u0131nda birer [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":33,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[52,50,53,56,49,54,55,51,57],"class_list":["post-24","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-genel","tag-ag-guvenligi","tag-bal-kupu-teknigi","tag-hacker-yakalama-yontemleri","tag-high-interaction-honeypot","tag-honeypot-nedir","tag-izolasyon-teknikleri","tag-low-interaction-honeypot","tag-siber-guvenlik-tuzaklari","tag-siber-tehdit-istihbarati"],"_links":{"self":[{"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/posts\/24","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/comments?post=24"}],"version-history":[{"count":1,"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/posts\/24\/revisions"}],"predecessor-version":[{"id":26,"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/posts\/24\/revisions\/26"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/media\/33"}],"wp:attachment":[{"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/media?parent=24"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/categories?post=24"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sezgineren.com\/Blog\/wp-json\/wp\/v2\/tags?post=24"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}