How to get the passwords the attackers used in a Brute Force Attack?

[DDewarSplunk]

Morning

I have been reading this article

https://www.splunk.com/blog/2017/06/16/detecting-brute-force-attacks-with-splunk.html

I wondered if there was any way of finding out what passwords the attackers used in a Brute Force Attack.
That's not something which is in the Splunk logs but would be interesting to see.

How would I go about gathering this info?
Thanks

D

[DDewarSplunk]

Thanks Frank,

That's what I suspected it is near impossible to get.
I was also wondering if the same applies to usernames the attackers used.

Again I suspect they just tried random over and over again in the hope of a match.

Thanks

D

[FrankVl]

username usually is logged also for failed attempts.

[FrankVl · Accepted solution]

Typically authentication mechanisms never log the passwords that were attempted. Key reason: if a genuine user makes a small typo, he practically gives away his password (especially if you were able to observe multiple different typos over time). In more advanced authentication schemes that use some kind of challenge-response mechanism, the server does not even see the plain password.

I vaguely recall there are some hacks for sshd to make it log passwords (for use on honeypot systems where you know there is only attackers trying to log in for instance), but that is not something for production systems I would say.

What kind of logins are you monitoring (windows, linux, web applications???), perhaps there is someone here who can answer in more detail specific to that platform.