diff options
| author | Ada Isopods <me@bathynomus.xyz> | 2025-05-22 00:08:29 -0600 |
|---|---|---|
| committer | Ada Isopods <me@bathynomus.xyz> | 2026-10-21 23:04:35 -0600 |
| commit | 11abd79cfa60b0b0758b957e5b42e5e206f1d41a (patch) | |
| tree | db2c29719ee2f8065d4e1e168868c1a64b15b1c9 /README.md | |
| parent | d71a4a6b8bb7773cef59e4dd7cb7327c68c68f2f (diff) | |
group passwords tried by corresponding username
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 9 |
1 files changed, 5 insertions, 4 deletions
@@ -14,26 +14,27 @@ Options: ``` -h, --help show this help message and exit -v, --verbose Make the output more verbose (do less to collapse less-interesting information) --V, --verboser Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events) +-V, --verboser Make the output even more verbose (one line per event) -W, --verbosest Make the output even more verboserer (dump as much information as possible as pretty-printed JSON) -P, --pings Include only connections where no authentication attempt was made -F, --fails Include only failed logins -L, --logins Include only successful logins where no commands were run -C, --commands Include only logins where only this list of basic test commands were run: ['uname', 'nproc'] -E, --eventful Include only the cool interesting sessions that aren't any of that other stuff --r, --redact-ip Redact IP addresses by converting them to 16-character hashes --i, --filter-ip FILTER_IP - Filter data to a specific IP, censored hash thereof, or netmask (127.0.0.1 / 0b39f7265d91e7c3 / 127.0.0.0/16) -u, --filter-username FILTER_USERNAME Filter data to uses of a specific username -p, --filter-password FILTER_PASSWORD Filter data to uses of a specific password. Pass "[SSH_PUBKEY_ATTEMPT]" to filter for attempts to log in using an SSH public key instead of a password, which does happen -z, --filter-sensor FILTER_SENSOR Filter data to a certain "sensor". Useful if Cowrie is running in proxy mode to multiple endpoints +-i, --filter-ip FILTER_IP + Filter data to a specific IP, censored hash thereof, or netmask (127.0.0.1 / 0b39f7265d91e7c3 / 127.0.0.0/16) +-r, --redact-ip Redact IP addresses by converting them to 16-character hashes -c, --no-color Don't color-code terminal output -s, --stats Print aggregated statistics -S, --only-stats Print only aggregated statistics ``` # TODO +- Filter by regex? - HTML output option
\ No newline at end of file |