From bf0823fc02d4beb303ec7ca7192afa6c3af92ff4 Mon Sep 17 00:00:00 2001 From: Ada Isopods Date: Thu, 15 May 2025 07:48:24 -0600 Subject: woahg Okay so I just - Implemented argparse - Universalized the IP filtering logic - Added verbosity settings, finally - Added something called "blank mode" where you can basically pick and choose what kinds of session you want to see - Moved the filtering logic I'd already implemented in low-verbosity mode to support blank mode to its own thing so it's universal among all the verbosity modes - Commented a bunch of stuff - Fixed a bug I ran into where if an extra-long "empty ping" is still open when the program is run it crashes. I just realized I should probably do that for all the session types actually I'm going to bed --- README.md | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 4162bd0..658c4d2 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,32 @@ -Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). Only tested on my setup. YMMV +Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). I think I got carried away with the specialized logging settings. Only tested on my setup. Untested with Telnet. YMMV # Usage ``` -python3 cowrieder.py cowrie.json +cowrieder.py filepath ``` -You can also filter it by IP address: +Options: ``` -python3 cowrieder.py cowrie.json 127.0.0.1 -``` \ No newline at end of file +-h, --help show this help message and exit +-v, --verbose Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones) +-vv, --verboser Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events) +-vvv, --verbosest Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON) +-B, --blank On default and low verbosity, print nothing whatsoever. Override this with other arguments to filter for only the stuff you care about +-P, --pings | With blank mode active, print "empty pings" +-F, --fails | With blank mode active, print failed logins +-L, --logins | With blank mode active, print "login pings" +-C, --commands | With blank mode active, on default verbosity, print "command pings" +-S, --sessions * With blank mode active, on default verbosity, print "interesting" sessions. With -v enabled, this and -C do the same thing. +-a, --stats Print aggregated statistics +-j, --json-stats Dump aggregated statistics as JSON +-i, --filter-ip FILTER_IP + Filter data to a specific IP +``` + +# Terminology + +- "Empty ping": Client connected and made no attempt to log in +- "Login ping": Client logged in successfully and did nothing +- "Command ping": Client logged in successfully and only ran `uname`, `nproc`, and/or `echo`. In my experience "command pings" comprise most insances of a client successfully logging in and then bothering to run any commands \ No newline at end of file -- cgit v1.2.3