Telnetlogger
This is a simple program to log login attempts on Telnet (port 23). It's designed to track the Mirai botnet. Right now (Oct 23, 2016) infected Mirai machines from around the world are trying to connect to Telnet on every IP address about once per minute. This program logs both which IP addresses are doing the attempts, and which passwords they are using. I wrote it primarily because installing telnetd on a Raspberry Pi wasn't sufficient. For some reason, the Mirai botnet doesn't like the output from Telnet, and won't try to login. So I needed something that produced the type of Telnet is was expecting. While I was at it, I also wrote some code to parse things and extract the usernames/passwords. Usage: Just run the program in order to see passwords and IP addresses appear on stdout. telnetlogger To log the information to files, use the -p and -i options. telnetlogger -p passwds.txt -i ips.txt To listen on another port (for testing and whatnot), use -l. telnetlogger -l 2323 Note that on many systems, you'll get an "access denied" error message, because programs that open ports below 1024 need extra priveleges. So you may need to sudo the program. Compiling Type make or:
FEATURES
SIMILAR TOOLS
Snort is an open source intrusion prevention system that uses rules to detect and prevent malicious network activity.
A free DNS recursive service that blocks malicious host names and protects user privacy.
A suite for man in the middle attacks, featuring sniffing of live connections, content filtering, and protocol dissection.
Tor Browser is a free and open-source software that allows users to browse the internet anonymously and privately.
NBD is a user-space network protocol for sharing block devices over a network, allowing clients to access block devices on a server as if they were local.
Tcpdump is a command-line packet analyzer for capturing and analyzing network traffic.
A free, open-source network protocol analyzer for capturing and displaying packet-level data.
WiGLE.net is a platform that collects and provides data on WiFi networks and cell towers, with over 1.3 billion networks collected.
PINNED
Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.