From beb2ad5ba0eda4098c29eb320368f1301850576b Mon Sep 17 00:00:00 2001 From: Ada Isopods Date: Wed, 14 May 2025 02:30:04 -0600 Subject: add filtering by ip as second arg --- cowrieder.py | 45 +++++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 20 deletions(-) (limited to 'cowrieder.py') diff --git a/cowrieder.py b/cowrieder.py index 707f4a0..756f4c7 100644 --- a/cowrieder.py +++ b/cowrieder.py @@ -2,13 +2,13 @@ import json import sys import random -if(len(sys.argv) < 2): +if not 0 <= 1 < len(sys.argv): print("Provide a path to a Cowrie JSON log file") exit() filepath = sys.argv[1] entries = [] sessions = [] -ips = {} +session_ips = {} with open(filepath, "r") as logfile: for line in logfile: @@ -17,23 +17,28 @@ with open(filepath, "r") as logfile: session = entry['session'] if(session not in sessions): sessions.append(session) - ips.update({session: entry['src_ip']}) + session_ips.update({session: entry['src_ip']}) + +filter_ip = "" +if 0 <= 2 < len(sys.argv): + filter_ip = sys.argv[2] for session in sessions: - ip = ips[session] - random.seed(session) - sr = random.randrange(50, 256) - sg = random.randrange(50, 256) - sb = random.randrange(50, 256) - random.seed(ip) - ir = random.randrange(50, 256) - ig = random.randrange(50, 256) - ib = random.randrange(50, 256) - print("\n--- Session \x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb) + session + "\x1b[0m from \x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib) + ips[session] + "\x1b[0m ---") - for entry in entries: - if(entry['session'] == session): - if(entry['message']): - eventid = entry['eventid'] - print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message']) - else: - print(entry["timestamp"] + " > " + entry['eventid']) \ No newline at end of file + ip = session_ips[session] + if(ip == filter_ip or not filter_ip): + random.seed(session) + sr = random.randrange(50, 256) + sg = random.randrange(50, 256) + sb = random.randrange(50, 256) + random.seed(ip) + ir = random.randrange(50, 256) + ig = random.randrange(50, 256) + ib = random.randrange(50, 256) + print("\n--- Session \x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb) + session + "\x1b[0m from \x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib) + session_ips[session] + "\x1b[0m ---") + for entry in entries: + if(entry['session'] == session): + if(entry['message']): + eventid = entry['eventid'] + print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message']) + else: + print(entry["timestamp"] + " > " + entry['eventid']) \ No newline at end of file -- cgit v1.2.3