Re: SSH Brute forcers

cudos! 

this version works MUCH better
(It actually runs hehehe) 

is there a way you can do a placeholder
so that only new items since the last tattle
are processed ?


also.. I might point out... 

http://www.abuse.net/using.phtml

may be a better solution to your whois lookups... 
ie only do whois on FAILED lookups at abuse.net

with this... sniped from the above page...

This snippet of perl code will do the lookup and return an array containing
the contact addresses: 

--->snip 

# look up contacts from abuse.net
use Net::DNS;
sub ablookup {
    my ($domain) = @_;
    my ($res, $query, @r);

    $res = new Net::DNS::Resolver;
    while(1) {
	$query = $res->search("$domain.contacts.abuse.net", "TXT");
	if ($query) {
	    my $rr;

	    foreach $rr ($query->answer) {
		push @r, $rr->txtdata if $rr->type eq "TXT";
	    }
	    return @r;
	} else { # Net::DNS rejects special characters, strip off
		 # subdomains and see if a parent domain works
	    if($domain =~ m{^[^.]+\.([^.]+\..+)}) {
		$domain = $1;
	    } else {
		die "Cannot lookup contacts for $domain";
	    }
	}
    }
}
<---snip


just a thot... 
faster and less chance of a heavily hit site 
from being black listed... 

kenneth gf brown
ceo shadowplay.net



> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of C.J. 
> Steele, CISSP
> Sent: June 7, 2005 06:15
> To: [email protected]
> Subject: Re: [Intrusions] SSH Brute forcers
> 
> 
> I've made a few bug fixes to `tattle` (including one that
> might prevent it from working at all on some systems), and 
> would readily accept more peer review of this, if any of you 
> are interested.  You can get the latest from 
> http://sodaphish.com/files/tattle
> 
> Those of you who have already provided feedback: please check
> the latest for fixes to your bugs.
> 
> Cheers,
> -C
> 
> --
> C.J. Steele, CISSP <[email protected]>
> _______________________________________________
> Intrusions mailing list
> [email protected] 
> http://www.dshield.org/mailman/listinfo/intrusions
> 

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions