diff options
| -rw-r--r-- | cowrieder.py | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/cowrieder.py b/cowrieder.py index 3f2436e..39cdcb2 100644 --- a/cowrieder.py +++ b/cowrieder.py @@ -160,10 +160,11 @@ def session_ran_command(session): # Was a command run during the session return False def session_saved_file(session): # Were any files saved to disk during the session + n = 0 for event in session: if(event['eventid'] == "cowrie.session.file_download"): - return True - return False + n += 1 + return n def session_is_cmdping(session): # Determine if a session qualifies as a "command ping" if(session_ran_command(session)): @@ -289,6 +290,7 @@ cnt_lping = 0 cnt_cmdping = 0 cnt_eventful = 0 cnt_filessaved = 0 +cnt_allfilessaved = 0 login_combos_by_ip = {} attempt_counts_by_ip = {} # Stats pertaining to source IPs @@ -334,8 +336,9 @@ for s_id in sessions: cnt_cmdping += 1 elif(session_ran_command(s) and not session_is_cmdping(s)): cnt_eventful += 1 - if(session_saved_file(s)): + elif(session_saved_file(s)): cnt_filessaved += 1 + cnt_allfilessaved += session_saved_file(s) for a in login_combos: update_cnt_by(a[0], attempt_counts_by_username) @@ -459,7 +462,8 @@ if(verbosity == 3): # Maximum verbosity: literally just dump everything we have 'login_no_action': cnt_lping, 'login_uneventful': cnt_cmdping, 'eventful': cnt_eventful, - 'saved_file': cnt_filessaved + 'saved_file': cnt_filessaved, + 'files_saved': cnt_allfilessaved } all_stats = { 'percentages': percentages, @@ -850,7 +854,7 @@ elif(args.html): print(' </article>') print(' <article>') print(' <h5>Files Saved</h5>') - print(' '+str(cnt_filessaved)) + print(' '+str(cnt_allfilessaved)) print(' </article>') print(' <article>') print(' <h5>Log Parsing Time</h5>') |