Through the use of event detection monitoring and do it yourself monitoring techniques on a Linux Apache PHP MySQL stack, I will demonstrate how you can create unique web application attack surfaces that alert you when someone is scanning your web application trying to do something they shouldn't. The case study will demonstrate the use of hacking tools as a defense strategy in a corporate network and will cover the story of the detection of insider threats from the internal application point of view. The entire presentation is a hands-on lab that can be used after the presentation as a guide for attendees to set up a Threat Detection program. Setup of an Active Defense Program- Load Balancers - Config Review- ModSecurity - Config Review- Log Collecting and Altering - Config Review- MySQL Log Watching - Config Review- FAIL2BAN - Config Review Reading HTTP Logs - looking for malicious actors Stopping Script Kiddies and Bots - User Agent Strings - blocking pentester tools with default configs by filtering user agent strings.- Robot.txt - setting up no-go zones as possible bait for bots to be used for detection. Traps- Systems Detection - Setting up interesting files on operating systems that send out alters when accessed.- Token String Detection - Setting up fake access tokens that no one should use for IDS and WAF detection.- Zombie Accounts - Setting up fake users credentials to be used for penetration detection.- False DB Tables - Setting up fake tables in a database for threat detection- Fake Domains - Creating fake domains to create more work and possible fake targets for attackers.- Fake URL/URI - Dead end functionality in the application that doesn't do anything other then looks like an interesting target for malicious activity.- Trap Ports - Setting up fake TCP/IP ports on critical servers that are only used for detection.- PHPmyAdmin Attack Surfaces - Fake PHPmyAdmin for attackers- Wordpress Login Attack Surfaces - Fake Wordpress setup.- Directories Attack Surfaces - Fake exposed directories with malicious payloads.- Slowing connections - Make attackers scans run longer.- Recursive Directory Loops - Make attackers scans continuously crash.- Random Success on Logins - Create weird bugs that look like vulnerabilities. - Url Redirects - Redirect attackers randomly making the app hard to map.- Random Log Outs - Change when a threat is logged out after a certain amount of time.- Random HTTP Response Codes - Sending back random response codes on fake URLs.-Using Social Engineering Tool Kit as a Defensive Tool-Using Browser Exploit Framework (BeEF) as a Defensive Tool