Home / Labs / Crack the Brute Force

Crack the Brute Force

3:12 AM, repeated SSH failures. Figure out how many attempts, which IP, and whether they got in.

Open this lab

Commands practised here

• grep 'Failed password' /var/log/auth.log | wc -lCounts total failed login attempts.
• grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rnRanks IPs by failed attempt count.
• grep 'Accepted' /var/log/auth.logShows all successful logins.
• grep 'Failed' /var/log/auth.log | awk '{print $9}' | sort | uniq -c | sort -rnShows which usernames were targeted.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Crack the Auth Log
• Contain the Breach