Man, that one Brazilian IP really going hard
That's what a typical attempt looks like unless they're progressively timed out with fw blocks
Brute.Fail: Watch brute force attacks fail in real time
31–40 of 268 posts
Re: Brute.Fail: Watch brute force attacks fail in real time
#32That’s neat. What’s the total volume per day? Are the passwords themselves being escaped in the final UI rendering? Otherwise you’d have an XSS for a password like “ /* code */ ". EDIT: Unless it's happening on the server side where it's being saved, I don't think they're being escaped: col1.innerHTML = ' ' + msg.src; col2.innerHTML = msg.proto; col3.innerHTML = ' ' + msg.u + ' '; col4.innerHTML = ' ' + msg.p + ' ';
It is escaped server side. Anything long enough to be a useful payload is trimmed.
How short we talking?
Since there's multiple opportunities to inject code, it's possible to split out the payload across multiple fields: https://www.highseverity.com/2011/06/xss-in-confined-spaces....
Ten characters per block is enough for:
/*
*/eval(/*
*/'....'+/*
*/'....'+/*
*/'....'+/*
...
*/)/*
*/
Re: Brute.Fail: Watch brute force attacks fail in real time
#33Earlier quoted context omitted.
it bugs me that they're not trying the passwords in lexigraphical order :-D also, who has sshd without `PermitRootPassword=no`? they need to broaden their horizons and try `admin`, `ec2-user`, and `ubuntu` /s
Who still allows password-based login for any SSH account, root or not? Keys, certificates, or Kerberos for all users.
Sometimes the default after creating the VM. Sometimes it is, if you start in the recovery mode (usually with a random long password)
Re: Brute.Fail: Watch brute force attacks fail in real time
#34Realtime honeypot
Re: Brute.Fail: Watch brute force attacks fail in real time
#35For this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere... Also started using Crowdsec recently, but not sure about if it's worth it... fail2ban out of the box works fine for SSH, but for dovecot and postfix it's somehow broken, and the configuration scripts are just too obtuse.
Nice idea. From the docs:
Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server.
Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't depend on any cryptographic libraries. It's a simple, single-threaded, standalone C program. It uses poll() to trap multiple clients at a time.
Re: Brute.Fail: Watch brute force attacks fail in real time
#36If this doesn't get to install fail2ban don't know what will.
I was actually thinking about that: OT1H, fail2ban would really clean up the list, so it's not monopolized by the one joker, but OTOH given sufficient spans of time it would make the output go quiet, which for this specific case defeats the purpose I actually much prefer the projects that give the caller a fake shell, and watch what they type after "breaking in." It'd be the Kitboga of ssh attacks :-D
I would 100% watch the Kitboga of ssh attacks, is that something that exists today? The closest I've seen so far is password purgatory - https://www.troyhunt.com/sending-spammers-to-password-purgat...
Re: Brute.Fail: Watch brute force attacks fail in real time
#37looks like it's getting hn-hugged to death.
Re: Brute.Fail: Watch brute force attacks fail in real time
#38I have an RDP server open to the internet(on a custom port) and it just receives an absolutely relentless stream of login attempts with all kinds of random logins. That's a private server on a private home IP, not associated with a known domain or anything. Changing the port stops it for about 24 hours then it starts again.
Re: Brute.Fail: Watch brute force attacks fail in real time
#39I have an RDP server open to the internet(on a custom port) and it just receives an absolutely relentless stream of login attempts with all kinds of random logins. That's a private server on a private home IP, not associated with a known domain or anything. Changing the port stops it for about 24 hours then it starts again.
Yeah, we have the same problem. I made a custom firewall rule and a python script that watches the windows logs for multiple failed logins to combat this and it seems to work pretty well but there's always new ips.
Re: Brute.Fail: Watch brute force attacks fail in real time
#40This is fun to watch, seeing all the passwords is pretty interesting. Just curious, why x out the IP at all?
> Just curious, why x out the IP at all? Trying to avoid being a jerk. The sources are likely hacked boxes where the owner has no idea.
> Trying to avoid being a jerk.
There are lists updated in real time by white hats, sharing exact IP of machines known to be engaging in bad behavior. You can, if you want, update your servers in real-time from these lists and then act accordingly: drop the traffic, reject the trafic, serve a "your IP address is participating in brute forcing attempts" page, etc.
FWIW some ISPs may be monitoring these looking for IPs on their subnets and acting accordingly.
It's not about "being a jerk". It's about giving attackers the middle finger.