Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Detect Brute-Force Attack in Event Logs
Mission
Analyze the authentication log `auth.log` to find traces of a brute-force attack. Aggregate failed logins per source IP; the flag is near the successful login of the IP with the outlier failure count.
Hints
Hint 1 Show
Count failed logins in auth.log per source IP
Hint 2 Show
The IP with an extreme failure count is the attacker
Hint 3 Show
The flag is near that IP's final successful (Accepted) login