0

I've set up a telnet honeypot and I'm looking for a library that could pull the IP address out of this:

[2021-02-22 10:28:06] [127.0.0.1:46368] AUTH: bog:bog
[2021-02-22 10:28:12] [127.0.0.1:46368] AUTH: :^]
[2021-02-22 10:28:13] [127.0.0.1:46368] AUTH: :
[2021-02-22 10:28:13] [127.0.0.1:46368] SESSION_END

Something in Python would be nice, but any language works.

1
  • On *nix you could just use awk, sed, cut, grep etc. Feb 26, 2021 at 23:53

1 Answer 1

1

The python re built in library, possibly with the regex or grin packages, looks good.

To get all of the unique IP addresses you could use something like:

import re

ip_addresses = set(re.findall(r'((?:[\d]{1,3}\.){3}\d{1,3})', open('file.log').read())
print(ip_addresses)

Adding the verbose flag to make things more readable:

import re

ip_addresses = set(re.findall(r'''
( # Capture Group
(?: # Non Capture Group
\d  # Digit
{1,3} # Between 1 & 3 times
\. # Literal .
) # End Non Capture Group
{3} # Repeat exactly 3 times
\d # Digit
{1,3} # Between 1 & 3 times
) # End capture group
''', open('file.log').read(), re.VERBOSE)

print(ip_addresses)

Of course you could use glob or argparse to make this into a utility script.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.