diff options
Diffstat (limited to 'cowrieder.py')
| -rw-r--r-- | cowrieder.py | 21 |
1 files changed, 18 insertions, 3 deletions
diff --git a/cowrieder.py b/cowrieder.py index 562cc8f..90cc39c 100644 --- a/cowrieder.py +++ b/cowrieder.py @@ -277,6 +277,7 @@ cnt_cmdping = 0 cnt_eventful = 0 cnt_filessaved = 0 +login_combos_by_ip = {} attempt_counts_by_ip = {} # Stats pertaining to source IPs def top_n_percent_of_ips_session_percent(n): # pretty self explanatory. Pass a float between 0 and 1 i = 0 @@ -303,6 +304,12 @@ for s_id in sessions: # Create list of credential combos used for a in session_cred_combos(s): login_combos.append(a) + # Group credential combos by IP + if(ip not in login_combos_by_ip): + login_combos_by_ip.update({ip: session_cred_combos(s)}) + else: + for a in session_cred_combos(s): + login_combos_by_ip[ip].append(a) # Count sessions by type if(not session_attempted_login(s)): cnt_pings += 1 @@ -338,6 +345,7 @@ attempt_counts_by_ip = dict(sorted(attempt_counts_by_ip.items(), key=lambda item attempt_counts_by_username = dict(sorted(attempt_counts_by_username.items(), key=lambda item: item[1], reverse=True)) attempt_counts_by_password = dict(sorted(attempt_counts_by_password.items(), key=lambda item: item[1], reverse=True)) passwords_by_username = dict(sorted(passwords_by_username.items(), key=lambda item: len(item[1]), reverse=True)) +login_combos_by_ip = dict(sorted(login_combos_by_ip.items(), key=lambda item: len(item[1]), reverse=True)) ips_by_attempt_count = cnt_by_to_by_cnt(attempt_counts_by_ip) usernames_by_attempt_count = cnt_by_to_by_cnt(attempt_counts_by_username) @@ -345,7 +353,7 @@ passwords_by_attempt_count = cnt_by_to_by_cnt(attempt_counts_by_password) # Printing logic coming up -def print_dict_of_lists(by_cnt, is_ip = False, truncate = 3, limit = -1): +def print_dict_of_lists(by_cnt, is_ip = False, key_is_ip = False, truncate = 3, limit = -1): name_max_length = 0 for item in by_cnt: if(name_max_length < len(str(item))): @@ -355,7 +363,10 @@ def print_dict_of_lists(by_cnt, is_ip = False, truncate = 3, limit = -1): for num in by_cnt: if(limit > 0 and entries_printed >= limit): break - out = (" " * (name_max_length - len(str(num)))) + str(num) + ": " + if(key_is_ip): + out = (" " * (name_max_length - len(str(num)))) + ppip(str(num), ttycolor=True) + ": " + else: + out = (" " * (name_max_length - len(str(num)))) + str(num) + ": " cnt = 0 for item in by_cnt[num]: if(verbosity == 0 and cnt >= truncate): @@ -541,6 +552,8 @@ else: # Default (low) verbosity: just the good stuff print_dict_of_lists(passwords_by_attempt_count) print("\n--- Passwords by username: ---") print_dict_of_lists(passwords_by_username) + print("\n--- IPs with credential combos tried: ---") + print_dict_of_lists(login_combos_by_ip, key_is_ip=True) else: print("\n--- Top source IP addresses by attempt count: ---") print_dict_of_lists(ips_by_attempt_count, True, limit = 20) @@ -550,4 +563,6 @@ else: # Default (low) verbosity: just the good stuff print_dict_of_lists(passwords_by_attempt_count, truncate=10, limit = 20) print("\n--- Top usernames with passwords tried: ---") print_dict_of_lists(passwords_by_username, truncate=10, limit = 20) - print_percentage_stats() + print("\n--- Top IPs with credential combos tried: ---") + print_dict_of_lists(login_combos_by_ip, truncate=7, limit = 20, key_is_ip=True) + print_percentage_stats()
\ No newline at end of file |