Brute.Fail: Watch brute force attacks fail in real time (brute.fail)

This is fun to watch, seeing all the passwords is pretty interesting.

Just curious, why x out the IP at all?

Seems like some of them are residential IP addresses! I guess parts of a botnet or a compromised device?

Man, that one Brazilian IP really going hard

That’s neat. What’s the total volume per day? Are the passwords themselves being escaped in the final UI rendering? Otherwise you’d have an XSS for a password like “<script>/* code */<script>".

EDIT: Unless it's happening on the server side where it's being saved, I don't think they're being escaped:

    col1.innerHTML = '<span class="fi fi-' + msg.cc + '" title="' + msg.cc + '"></span> ' + msg.src;
    col2.innerHTML = msg.proto;
    col3.innerHTML = '<code>' + msg.u + '</code>';
    col4.innerHTML = '<code>' + msg.p + '</code>';

    <script>/*
    */eval(/*
    */'....'+/*
    */'....'+/*
    */'....'+/*
    ...
    */)/*
    */</script>

    const span = document.createElement('span')
    span.setAttribute('class', 'fi fi'+msg.cc)
    span.setAttribute('title', msg.cc)

    col1.appendChild(span)
    col1.appendChild(document.createTextNode(msg.src))

    col2.textContent = msg.proto

    let code = document.createElement('code')

    code.textContent = msg.u
    col3.appendChild(code)

    code = code.cloneNode(true)
    code.textContent = msg.p
    col4.appendChild(code)

I kinda want to know the server's address so I can send a "hello_hn" message in the passwords there.

This is cool... is it open source? :)

Oh that’s pretty fucking cool.

Is code available anywhere?

I run a slowly growing network of SSH honeypots that do central logging (Greylog), that I’ve been meaning to document the setup of for here somewhen.

Bolting something like this onto that would be pretty funny.

Damm, the same brazilian IP is trying really, really hard

If this doesn't get to install fail2ban don't know what will.

For this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere...

Also started using Crowdsec recently, but not sure about if it's worth it...

fail2ban out of the box works fine for SSH, but for dovecot and postfix it's somehow broken, and the configuration scripts are just too obtuse.

Its just stupid at this point. You can put up a wordpress site with 5 daily visitors, and you'll still get thousands of SSH / xmlrpc hits per day.

Realtime honeypot

looks like it's getting hn-hugged to death.

I have an RDP server open to the internet(on a custom port) and it just receives an absolutely relentless stream of login attempts with all kinds of random logins. That's a private server on a private home IP, not associated with a known domain or anything. Changing the port stops it for about 24 hours then it starts again.

I like that I'm not alone in the world of obsessively looking at my log files.

I put on my firewall a block for incoming traffic for all IPs outside Europe which helped a lot with the quantity of attempts.

Getting PR_END_OF_FILE_ERROR on Firefox, anyone else?

A remark on your fail.js, since you’re engaging here and I figure this could interest you or others:

Once there are more than thirty rows, you fade rows in like this:

  row.style.opacity = 0;
  let intervalId = setInterval(function() {
      opacity = Number(window.getComputedStyle(row).getPropertyValue("opacity"));
      if (opacity < 1) {
          opacity = opacity + 0.1;
          row.style.opacity = opacity;
      } else {
          clearInterval(intervalId);
      }
  }, 100);

This would be better done with a CSS animation or transition—it takes less code, and is smoother.

My suggestion: use animation. Replace the JavaScript with this:

  row.classList.add("fade-in");

And add this CSS:

  .fade-in {
      animation: 1s fade-in;
  }

  @keyframes fade-in {
      from { opacity: 0; }
  }

This does behave a little differently, as if the window isn’t visible, it’ll (roughly) wait until you focus the window before playing the animation. Frankly this is even mildly more desirable.

The alternative: use transitions, which are a tad more involved because you have to trigger the value change one frame later, so that it recognises that something has changed and interpolates to it, rather than it just being the initial value and applied instantly. This JS would do:

  row.style.transition = "1s opacity";
  row.style.opacity = 0;
  requestAnimationFrame(() => {
      row.style.opacity = 1;
  });

Or you could express it with more CSS, like with this CSS + JS:

  tr {
      transition: 1s opacity;
  }

  .invisible {
      opacity: 0;
  }

  row.classList.add("invisible");
  requestAnimationFrame(() => {
      row.classList.remove("invisible");
  });

—⁂—

You might also like `vertical-align: middle` on your spin.svg.

—⁂—

On the flag icons, here’s a cool alternative technique: https://en.wikipedia.org/wiki/Regional_indicator_symbol. Lets you avoid needing even images. Unfortunately, I think Windows still doesn’t ship flags, so you’ll get the two-letter country code there. You can get around this by packaging a web font. It’d be nice if someone would neatly package a flags-only font so others can easily use it. Here’s what I did a few months back for https://ganintegrity.com/country-profiles/, resulting in a single 77KB font file:

  /**
  Copyright 2020 Twitter, Inc and other contributors
  Graphics licensed under CC-BY 4.0: https://creativecommons.org/licenses/by/4.0/
  Twemoji Mozilla packaging via https://github.com/mozilla/twemoji-colr, subset to only include country flags.
  */
  @font-face {
      font-family: flag;
      /* (Generated with `pyftsubset /opt/firefox-nightly/fonts/TwemojiMozilla.ttf --unicodes="U+1F1E6-1F1FF" --output-file=static/TwemojiMozillaFlags.woff2 --flavor=woff2`.) */
      src: url(/static/TwemojiMozillaFlags.woff2) format("woff2");
  }
  
  /* Why do we do this? Because at the time of writing Windows doesn’t do flags, so ‹guzzled by HN› will look like “ᴀᴜ” rather than an Australian flag. (macOS and major browsers on Linux do.) */
  .flag {
      font-family: flag;
  }

Thinking about it, fail2ban is almost entirely a placebo given that your password should be basically impossible to brute force anyways if you have the knowledge to implement fail2ban.

be careful, this website is easy to vandalize

So funny story, for a while I worked on a 'reverse' exploit. Which is to say morphing the response from ssh to the client with large malformed packets. The idea was to crash the client making the request. In my case I found these attacks would have like 6 to 10 attempts from the same source address. By time stamping the requests, I could evaluate if the next attack from the same address came more quickly or more slowly. I then had my server "morph" the return payload somewhat randomly and keep the three responses that caused the most slowdown. When I got to 100 variants that had "won" this selection criteria I took the three best and started over from there. After a couple of months of this I finally got a response where after one request I would not get a second.

I felt extremely pleased with myself for about another month, and then my server address got hit with a massive DDOS attack (for me anyway) over my 6MBPS DSL line. So clearly I had hit a nerve somewhere :-). Anyway, I moved my server to a different address and used fail2ban to just note source IPs and put them into the IP tables as banned addresses. That works great and hasn't resulted in the same sort of drama as last time.

  logpath = /var/log/auth.log

  failregex = .*Connection closed by authenticating user [a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$) <HOST> port [0-9]* \[preauth\]

This is amazing!

Are you open sourcing this?

Can others stream their logs to your servers and have a crowdsourced list of attackers in real time together with their activity?

Are these really failures though? This is just how brute force works.

Some of these credentials could be of legitime users who have just mistyped the IP address.

Server down