Security

How to get the passwords the attackers used in a Brute Force Attack?

New Member

Morning

I have been reading this article

https://www.splunk.com/blog/2017/06/16/detecting-brute-force-attacks-with-splunk.html

I wondered if there was any way of finding out what passwords the attackers used in a Brute Force Attack.
That's not something which is in the Splunk logs but would be interesting to see.

How would I go about gathering this info?
Thanks

D

0 Karma
1 Solution

Ultra Champion

Typically authentication mechanisms never log the passwords that were attempted. Key reason: if a genuine user makes a small typo, he practically gives away his password (especially if you were able to observe multiple different typos over time). In more advanced authentication schemes that use some kind of challenge-response mechanism, the server does not even see the plain password.

I vaguely recall there are some hacks for sshd to make it log passwords (for use on honeypot systems where you know there is only attackers trying to log in for instance), but that is not something for production systems I would say.

What kind of logins are you monitoring (windows, linux, web applications???), perhaps there is someone here who can answer in more detail specific to that platform.

View solution in original post

0 Karma

New Member

Thanks Frank,

That's what I suspected it is near impossible to get.
I was also wondering if the same applies to usernames the attackers used.

Again I suspect they just tried random over and over again in the hope of a match.

Thanks

D

0 Karma

Ultra Champion

username usually is logged also for failed attempts.

0 Karma

Ultra Champion

Typically authentication mechanisms never log the passwords that were attempted. Key reason: if a genuine user makes a small typo, he practically gives away his password (especially if you were able to observe multiple different typos over time). In more advanced authentication schemes that use some kind of challenge-response mechanism, the server does not even see the plain password.

I vaguely recall there are some hacks for sshd to make it log passwords (for use on honeypot systems where you know there is only attackers trying to log in for instance), but that is not something for production systems I would say.

What kind of logins are you monitoring (windows, linux, web applications???), perhaps there is someone here who can answer in more detail specific to that platform.

View solution in original post

0 Karma