"Python" Hackback (Get the IP source of brute force server password)

Source: Internet
Author: User
Tags geoip response code

1. Preface

Again on the 0x00sec to the good stuff.

https://0x00sec.org/t/python-hackback-updated/882

The script in the post gets the IP and username that have failed the brute server password, and uses the Shodan API to do a traceability.

#!/usr/bin/python3.4import reimport urllib.requestimport jsonlog_path = "/var/log/auth.log" hosts = []key = "{YOUR_API_ KEY} "#GET FAILED PASSWORD attemptdef get_host (test): For line in Text.split (' \ n '): If Line.find (" Fai LED password for invalid ")! = -1:if Get_ip (line) not in Hosts:hos Ts.append (GET_IP) return hosts#get usernamedef get_username (line): Username_word = Line.split ("Failed Password for invalid user ") Username = (username_word[1]). Split (" ") return Username[0] #LOCATE IP with Geoi Pdef GeoIP (host): Response = Urllib.request.urlopen ("http://freegeoip.net/json/" +host) GeoIP = Response.read (). Decode ("Utf-8") GeoIP = Json.loads (geoip) print ("\n[+] Tracking IP {}". Format (geoip[' IP ')) print ( "-------------------------------") print (' \tcountry: {}\n\ttimezone: {}\n\tlatitude: {}\n\tlongitude: {} '). forma T (geoip[' country_name '],geoip[' time_zone '],geoip[' latitude '],geoip[' longitude ']) def Passive_recon (host,key): url = "Https://api.shodan.io/sho                Dan/host/{}?key={}&minify=true ". Format (host,key) try:response = Urllib.request.urlopen (URL) result = Response.read (). Decode (' utf-8 ') result = Json.loads (result) print ("[+] Passive Recon using Shodan.io ") print ("-------------------------------") Print (" \tport: {}\                        n\torganisation {} ". Format (result[' ports '],result[' org '))) for X in range (len (result[' ports ']): Print ("Banner {}". Format (result[' data '][x][' data ')) Except:print ("[+] Passive Recon u Sing Shodan.io ") print ("-------------------------------") print (" \tcan ' t retrieve Informatio n ") passif __name__ = =" __main__ ": With open (Log_path, ' RT ') as Log:text = Log.read ( ) Get_host (text) for host In Hosts:geoip (Host) Passive_recon (Host,key) 
2, the function of the script implementation
def get_host(test):        for line in text.split(‘\n‘):                if line.find("Failed password for invalid ") != -1:                        if get_ip(line) not in hosts:                                hosts.append(get_ip(line))        return hostsdef get_username(line):        username_word = line.split("Failed password for invalid user ")        username = (username_word[1]).split(" ")        return username[0]

These functions will get the IP and user name of the test server password from the Auth.log file

Using Freegeoip.net to get an IP location (but you can also use the Shodan.io API), the function simply parses the JSON output into a glorified text output.

def geoip(host):        response = urllib.request.urlopen("http://freegeoip.net/json/"+host)        geoip = response.read().decode("utf-8")        geoip = json.loads(geoip)        print("\n[+] Tracking ip {}".format(geoip[‘ip‘]))        print("-------------------------------")        print(‘\tCountry : {}\n\ttimezone : {}\n\tlatitude : {}\n\tlongitude : {}‘.format(geoip[‘country_name‘],geoip[‘time_zone‘],geoip[‘latitude‘],geoip[‘longitude‘]))

The script functions associated with Shodan are as follows:

def passive_recon(host,key):        url = "https://api.shodan.io/shodan/host/{}?key={}&minify=true".format(host,key)        try:                response = urllib.request.urlopen(url)                result = response.read().decode(‘utf-8‘)                result = json.loads(result)                print("[+] Passive Recon using shodan.io")                print("-------------------------------")                print("\tPort : {}\n\tOrganisation {}".format(result[‘ports‘],result[‘org‘]))                for x in range(len(result[‘ports‘])):                        print("Banner {}".format(result[‘data‘][x][‘data‘]))        #If we don‘t get a 200 response code print ‘Can‘t retrive information        except:                print("[+] Passive Recon using shodan.io")                print("-------------------------------")                print("\tCan‘t retrieve information")                pass

To get information about hackers, you only need to run:

./hackBack.py

"Python" Hackback (Get the IP source of brute force server password)

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.