13 ms·
Brute.Fail: Watch brute force attacks fail in real time
- segmondy 3y agoI use port knocking on 3 preselected ports to open up ssh which is not on port 22. I can't bother to have my logs cluttered with these garbage.
- blakesterz 3y agoThis is fun to watch, seeing all the passwords is pretty interesting. Just curious, why x out the IP at all?
- zeta0134 3y agoPresumably many brute force attempts come from compromised residential PCs, whose owners may not be aware that they are participating in an attack. It's not especially polite to expose all of that personal info.
- mike_d 3y ago> Just curious, why x out the IP at all? Trying to avoid being a jerk. The sources are likely hacked boxes where the owner has no idea.
- Filligree 3y agoAnd since they don't get called out, they won't get an idea. Unless the infection is retargeted against themselves.
- mike_d 3y agoI also scan the internet quite a bit. Trust me, they (or the ISP rather) are getting a few emails an hour.
- nubinetwork 3y ago> few emails an hour Been there, done that. Most isps and providers don't respond or act on abuse complaints anymore.
- TacticalCoder 3y ago> Trying to avoid being a jerk. There are lists updated in real time by white hats, sharing exact IP of machines known to be engaging in bad behavior. You can, if you want, update your servers in real-time from these lists and then act accordingly: drop the traffic, reject the trafic, serve a "your IP address is participating in brute forcing attempts" page, etc. FWIW some ISPs may be monitoring these looking for IPs on their subnets and acting accordingly. It's not about "being a jerk". It's about giving attackers the middle finger.
- mardifoufs 3y agoSeems like some of them are residential IP addresses! I guess parts of a botnet or a compromised device?
- jethro_tell 3y agoInternet of things. Lets put 20 unpatched linux computers on every network and see how that goes.
- jabroni_salad 3y ago"residential proxy" is a very popular black market service, since it's less straightforward for website owners to block than other common vpn termination points. These applications market themselves as free VPN services, get loaded by special offers bolted onto legitimate software installers, or are added to trojanized pirate distributions of popular applications.
- slater 3y agoMan, that one Brazilian IP really going hard
- mdaniel 3y agoit bugs me that they're not trying the passwords in lexigraphical order :-D also, who has sshd without `PermitRootPassword=no`? they need to broaden their horizons and try `admin`, `ec2-user`, and `ubuntu` /s
- tjohns 3y agoWho still allows password-based login for any SSH account, root or not? Keys, certificates, or Kerberos for all users.
- banana_giraffe 3y agoYou'd think, but yet one still sees one or two posts a week to SO or whatever forum asking how to enable password-based login to AWS EC2 instances. Often with screenshots showing '0.0.0.0/0' as the allowed incoming range.
- kenniskrag 3y agoSometimes the default after creating the VM. Sometimes it is, if you start in the recovery mode (usually with a random long password)
- Enginerrrd 3y agoI do. For some reason ssh keys became the group-think security advice to repeat ad nauseam. I often find people have only considered this very shallowly, and their reasoning is just "But OMG, entropy lolz" without actually seriously considering the available entropy and likely attack vectors and failure. Why? The benefits are largely theoretical if you choose sufficiently strong randomly generated passphrases, with some symbols and numbers mixed in, which I set my password manager to do. (Actually, I have a couple of super important, super long ones I keep only in my head.) The draw-backs however are several: 1. I find that its not uncommon I find myself having to chain together ssh tunnels and other strange things to debug networking issues and need to login to another machine from a new machine that doesn't have the ssh-key. Treating servers as cattle exacerbates this issue since it's more likely to occur. 2. If a machine or server I use to manage stuff as a gateway/proxy/vpn entry to my network has all my ssh keys on it, and it becomes compromised because of some 0-day, the attacker now basically has access to... multiple entire networks. Now, this is technically true of my password manager as well, except that the context / IP addresses, etc, is not going to be as obvious as it will be on the server where the attacker can see the running services, check logs, command histories, etc. With the password-based management, sure I could get hit by a keylogger, but everything won't be compromised by default. 3. In my experience, you're more likely to lock yourself out than let an attacker in. You basically still have to have your keys managed via some type of password manager anyway because otherwise you run the risk of getting locked out of everything in case you're away from your primary machine and need to address some emergency or something.
- koolba 3y agoThat’s neat. What’s the total volume per day? Are the passwords themselves being escaped in the final UI rendering? Otherwise you’d have an XSS for a password like “<script>/* code */<script>". EDIT: Unless it's happening on the server side where it's being saved, I don't think they're being escaped: col1.innerHTML = '<span class="fi fi-' + msg.cc + '" title="' + msg.cc + '"></span> ' + msg.src; col2.innerHTML = msg.proto; col3.innerHTML = '<code>' + msg.u + '</code>'; col4.innerHTML = '<code>' + msg.p + '</code>';
- mike_d 3y agoIt is escaped server side. Anything long enough to be a useful payload is trimmed.
- koolba 3y agoHow short we talking? Since there's multiple opportunities to inject code, it's possible to split out the payload across multiple fields: https://www.highseverity.com/2011/06/xss-in-confined-spaces.html https://www.highseverity.com/2011/06/xss-in-confined-spaces.... Ten characters per block is enough for: <script>/* */eval(/* */'....'+/* */'....'+/* */'....'+/* ... */)/* */</script> Best to escape everything at render time.
- mike_d 3y agoEverything is escaped server side before it is sent to the client. Shoot me an email and I will let you play with it after the HN traffic dies down.
- jamesnorden 3y ago[dead]
- mike_hock 3y agoAs the other comment said, just write proper code instead of going "oh but it's escaped and size-limited." JS has sane APIs where no string is "dangerous," use them.
- ok_dad 3y agoI kinda want to know the server's address so I can send a "hello_hn" message in the passwords there.
- spuz 3y agoI tried the IP resolved by the domain "brute.fail" but it doesn't accept SSH connections :)
- dmurray 3y agoThe Internet is not that big, though. You could potentially try all 2^32 IPv4 addresses with your password of choice and see when it came up here.
- Dwedit 3y agoThere's an infamous classic image out there titled "How to catch Script kiddies" which involves four nested For-loops, then placing the generated 1.1GB .txt file on a torrent site under the name "Every IP Address Ever (Hacker Tool)"
- sltkr 3y agoI tried mikedamm.com (the author's domain) and it does accept SSH but my failed login attempts don't show up.
- seabass-labrax 3y agoFun idea, but the data for this site (which is streamed via a WebSocket) doesn't contain that information :)
- fragmede 3y agoUpthread the author says one of the three servers is in Digital Ocean, which gives you an AS to target. Reverse engineer the web page so you can capture the websocket to your terminal, grep it for your IP, and search all of DO's ipv4 address space. use Shodan to limit your targets to only machines with an open port 22 to make it go faster.
- jonfairbanks 3y agoThis is cool... is it open source? :)
- fullspectrumdev 3y agoOh that’s pretty fucking cool. Is code available anywhere? I run a slowly growing network of SSH honeypots that do central logging (Greylog), that I’ve been meaning to document the setup of for here somewhen. Bolting something like this onto that would be pretty funny.
- mike_d 3y agoNo code yet, it was literally pieced together last night. It is only processing SSH attempts from 3 hosts right now (one in colo, one EC2, one DigitalOcean) because when I pointed the full firehose at it the user experience of the website wasn't great.
- Elrecoal 3y agoDamm, the same brazilian IP is trying really, really hard
- OptionX 3y agoIf this doesn't get to install fail2ban don't know what will.
- lloydatkinson 3y agoAnd SSH key only login
- mdaniel 3y agoI was actually thinking about that: OT1H, fail2ban would really clean up the list, so it's not monopolized by the one joker, but OTOH given sufficient spans of time it would make the output go quiet, which for this specific case defeats the purpose I actually much prefer the projects that give the caller a fake shell, and watch what they type after "breaking in." It'd be the Kitboga of ssh attacks :-D
- Sodman 3y agoI would 100% watch the Kitboga of ssh attacks, is that something that exists today? The closest I've seen so far is password purgatory - https://www.troyhunt.com/sending-spammers-to-password-purgatory-with-microsoft-power-automate-and-cloudflare-workers-kv/ https://www.troyhunt.com/sending-spammers-to-password-purgat...
- OrangeMusic 3y ago> give the caller a fake shell, and watch what they type after "breaking in." Oh YES! Do it, please! We could learn a lot!
- nubinetwork 3y agoI believe one of ISC dshield's related projects can do this.
- mdaniel 3y agoThanks for the reference; after some link chasing I was able to end up on the project I believe you're thinking of: https://github.com/cowrie/cowrie#features https://github.com/cowrie/cowrie#features (appears to be BSD-3-Clause: https://github.com/cowrie/cowrie/blob/master/LICENSE.rst https://github.com/cowrie/cowrie/blob/master/LICENSE.rst )
- vsviridov 3y agoFor this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere... Also started using Crowdsec recently, but not sure about if it's worth it... fail2ban out of the box works fine for SSH, but for dovecot and postfix it's somehow broken, and the configuration scripts are just too obtuse.
- kenniskrag 3y agoNice idea. From the docs: Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server. Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't depend on any cryptographic libraries. It's a simple, single-threaded, standalone C program. It uses poll() to trap multiple clients at a time. https://github.com/skeeto/endlessh https://github.com/skeeto/endlessh
- jhartwig 3y agoWow. That is pretty brilliant.
- artursapek 3y agoThat’s hilarious
- operator-name 3y agoI'd be cautious about stuff like this - if you annoy the wrong person that could paint a target on your back.
- capableweb 3y agoRealistically though, they'll probably timeout by themselves automatically if they haven't seen a password prompt after N seconds. TCP connections can hang overall, so having that would be basics anyway.
- 3y ago
- koromak 3y agoIts just stupid at this point. You can put up a wordpress site with 5 daily visitors, and you'll still get thousands of SSH / xmlrpc hits per day.
- andyp-kw 3y agoThe range of IPV4 address's is small enough that a single server can scan it, in a single day. So I guess the problem isn't going away.
- m00dy 3y agoRealtime honeypot
- 0___0 3y agohttp://www.m-d.net/projects.php http://www.m-d.net/projects.php
- slater 3y agolooks like it's getting hn-hugged to death.
- technics256 3y agoGuess it got brute forced
- tiagod 3y agoTwo hours layer, it's still dead.
- Kailhus 3y agoYep, totally pwned
- quickthrower2 3y agoHugged on port 80/443 or 22
- gambiting 3y agoI have an RDP server open to the internet(on a custom port) and it just receives an absolutely relentless stream of login attempts with all kinds of random logins. That's a private server on a private home IP, not associated with a known domain or anything. Changing the port stops it for about 24 hours then it starts again.
- omgmajk 3y agoYeah, we have the same problem. I made a custom firewall rule and a python script that watches the windows logs for multiple failed logins to combat this and it seems to work pretty well but there's always new ips.
- SlavikCA 3y agoIPBan does that: https://github.com/DigitalRuby/IPBan https://github.com/DigitalRuby/IPBan
- gambiting 3y agoOh I didn't know this existed - will definitely set it up, thank you!
- justsomehnguy 3y agohttps://github.com/al-ign/Protect-RDSFromBruteforce https://github.com/al-ign/Protect-RDSFromBruteforce
- Solvency 3y agoI know nothing about networking, so pardon the ignorance: Why isn't there (or is there) some kind of service you can use to map some crazy URL to your personalip:port, like... http://obscuremyshit.com/393nnasjhf83u98723401 http://obscuremyshit.com/393nnasjhf83u98723401 = personalip:port And only when a connection is referred from that source, does the RDP server even expose itself? And for all other traffic that hits personalip:port, it does absolutely nothing?
- omgmajk 3y agoI like that I'm not alone in the world of obsessively looking at my log files.
- menotyou 3y agoI put on my firewall a block for incoming traffic for all IPs outside Europe which helped a lot with the quantity of attempts.
- Gunnerhead 3y agoVery naive question: can a bad actor just use a VPN to get around this?
- marcrosoft 3y agoYes
- flangola7 3y agoNot if you also block VPNs
- oriettaxx 3y agois it possible? how did you filter? (I've tried 2 years ago: at that time even aws is not able to provide a reliable EU ip list)
- LaputanMachine 3y agoI use this setup [1] on my servers. IPs are mapped to countries using Maxmind's GeoLite2 database. Linux's Tcp Wrappers are configured to block access for all IPs that aren't in my country. A custom fail2ban jail adds all IPs that get blocked by the Tcp Wrappers to the system's firewall. [1]: https://www.axllent.org/docs/ssh-geoip/ https://www.axllent.org/docs/ssh-geoip/
- ztgasdf 3y agoGetting PR_END_OF_FILE_ERROR on Firefox, anyone else?
- drewg123 3y agoI was too.. I then disabled DNS over https (which was pointing at nextdns) and it started working. Not sure if that was coincidence or an actual fix
- chrismorgan 3y agoA remark on your fail.js, since you’re engaging here and I figure this could interest you or others: Once there are more than thirty rows, you fade rows in like this: row.style.opacity = 0; let intervalId = setInterval(function() { opacity = Number(window.getComputedStyle(row).getPropertyValue("opacity")); if (opacity < 1) { opacity = opacity + 0.1; row.style.opacity = opacity; } else { clearInterval(intervalId); } }, 100); This would be better done with a CSS animation or transition—it takes less code, and is smoother. My suggestion: use animation. Replace the JavaScript with this: row.classList.add("fade-in"); And add this CSS: .fade-in { animation: 1s fade-in; } @keyframes fade-in { from { opacity: 0; } } This does behave a little differently, as if the window isn’t visible, it’ll (roughly) wait until you focus the window before playing the animation. Frankly this is even mildly more desirable. The alternative: use transitions, which are a tad more involved because you have to trigger the value change one frame later, so that it recognises that something has changed and interpolates to it, rather than it just being the initial value and applied instantly. This JS would do: row.style.transition = "1s opacity"; row.style.opacity = 0; requestAnimationFrame(() => { row.style.opacity = 1; }); Or you could express it with more CSS, like with this CSS + JS: tr { transition: 1s opacity; } .invisible { opacity: 0; } row.classList.add("invisible"); requestAnimationFrame(() => { row.classList.remove("invisible"); }); —⁂— You might also like `vertical-align: middle` on your spin.svg. —⁂— On the flag icons, here’s a cool alternative technique: https://en.wikipedia.org/wiki/Regional_indicator_symbol https://en.wikipedia.org/wiki/Regional_indicator_symbol. Lets you avoid needing even images. Unfortunately, I think Windows still doesn’t ship flags, so you’ll get the two-letter country code there. You can get around this by packaging a web font. It’d be nice if someone would neatly package a flags-only font so others can easily use it. Here’s what I did a few months back for https://ganintegrity.com/country-profiles/ https://ganintegrity.com/country-profiles/, resulting in a single 77KB font file: /** Copyright 2020 Twitter, Inc and other contributors Graphics licensed under CC-BY 4.0: https://creativecommons.org/licenses/by/4.0/ Twemoji Mozilla packaging via https://github.com/mozilla/twemoji-colr, subset to only include country flags. */ @font-face { font-family: flag; /* (Generated with `pyftsubset /opt/firefox-nightly/fonts/TwemojiMozilla.ttf --unicodes="U+1F1E6-1F1FF" --output-file=static/TwemojiMozillaFlags.woff2 --flavor=woff2`.) */ src: url(/static/TwemojiMozillaFlags.woff2) format("woff2"); } /* Why do we do this? Because at the time of writing Windows doesn’t do flags, so ‹guzzled by HN› will look like “ᴀᴜ” rather than an Australian flag. (macOS and major browsers on Linux do.) */ .flag { font-family: flag; }
- boringuser2 3y agoThinking about it, fail2ban is almost entirely a placebo given that your password should be basically impossible to brute force anyways if you have the knowledge to implement fail2ban.
- alexchamberlain 3y agoBetter: just ban password logins, and use cryptographic keys instead.
- quickthrower2 3y agoUse Role Based Access Control
- awestroke 3y agoIt can conserve server resources to just stop responding to brute force attacks
- veave 3y agoIf your server is a Gameboy, maybe.
- boringuser2 3y agoA Gameboy would probably have the computing resources to do a thousand such calculations a millisecond.
- blueflow 3y agoAlso disk space - i don't want to keep 500 MB of failed login attempts just to have a week of syslog available.
- boringuser2 3y agoRotate your logs bud. Also, suppressing these logs is the same as rapidly rotating new logs.
- artursapek 3y agobe careful, this website is easy to vandalize
- Dwedit 3y agoIt's easy to see that *certain website* has not yet found this host, judging by the lack of *certain words*.
- ChuckMcM 3y agoSo funny story, for a while I worked on a 'reverse' exploit. Which is to say morphing the response from ssh to the client with large malformed packets. The idea was to crash the client making the request. In my case I found these attacks would have like 6 to 10 attempts from the same source address. By time stamping the requests, I could evaluate if the next attack from the same address came more quickly or more slowly. I then had my server "morph" the return payload somewhat randomly and keep the three responses that caused the most slowdown. When I got to 100 variants that had "won" this selection criteria I took the three best and started over from there. After a couple of months of this I finally got a response where after one request I would not get a second. I felt extremely pleased with myself for about another month, and then my server address got hit with a massive DDOS attack (for me anyway) over my 6MBPS DSL line. So clearly I had hit a nerve somewhere :-). Anyway, I moved my server to a different address and used fail2ban to just note source IPs and put them into the IP tables as banned addresses. That works great and hasn't resulted in the same sort of drama as last time.
- fireant 3y agoWow that's a cool evolutionary algorithm in practice! I'm actually surprised it worked, especially with the amount of fuzzing I'd expect ssh ecosystem to receive (well perhaps the servers do, but not the clients haha).
- quickthrower2 3y agoDistributed valgrind
- sneak 3y agoDisable password authentication and fail2ban becomes completely unnecessary.
- nico 3y agoYou still get the attacks and they show in the logs Also, it’s not just ssh, there are brute force attacks for pretty much any service that you run Our logs show automated attempts to run exploits on our web servers everyday
- nico 3y agoThis is amazing! Are you open sourcing this? Can others stream their logs to your servers and have a crowdsourced list of attackers in real time together with their activity?
- creeble 3y agoSee abuseipdb.com if you care about this.
- nico 3y agoThank you! Wish the ISPs would subscribe to this and blocked traffic from the abusive IPs in their networks Clicked on a random IP on the front page, it said it’s from Palo Alto Networks in Santa Clara, that it was first reported in 2022 and the last report was 5min ago. So that IP has been doing shady stuff for months and it seems their ISP (Palo Alto Networks) doesn’t really care
- Dah00n 3y agoPalo Alto Networks is doing the scanning themselves. I see them in my logs all the time. Won’t do much good to report an abuser to an abuser. They are a “cybersecurity company” like most malicious companies.
- bootsmann 3y agoHey we actually built the second part as a product. Its a modern revamp of fail2ban combined with crowdsourcing aspect to deliver an up-to-date blocklist of active threats. You can check it out at https://github.com/crowdsecurity/crowdsec https://github.com/crowdsecurity/crowdsec
- nonethewiser 3y agoAre these really failures though? This is just how brute force works.
- avodonosov 3y agoSome of these credentials could be of legitime users who have just mistyped the IP address.
- rabuse 3y agoThe odds of that are slim to none.
- londons_explore 3y agoI'm of the opinion that if they accidentally leak their credentials to anyone, they might as well leak them to everyone. Sure, the risk of compromise goes up, but the whole culture of "we only sent those passwords once on unencrypted ftp across the internet" leads to powerful nation state spies having a field day... If all unencrypted data sent over the internet were in a big public archive for everyone to see, then people would soon clean up their security habits.
- BLKNSLVR 3y agoIn the intro text it specifically says: No legitimate services are offered on the addresses receiving these attempts, so there is no chance of a real user accidently submitting their credentials. (Yes things other than SSH occasionally show up)
- msephton 3y agoServer down
- nubinetwork 3y agoThis sounds interesting. When it comes to my setup, I don't even answer their connection attempts. I just log the IP and call it a day. You'd think that would be enough for them to stop, but I have some IPs with 25k connection attempts over a 90 day span. (Of course it had to be someone using digitalocean)
- satvikpendem 3y agoThis site is now brought down due to the collective brute forcing of HNers visiting the site, as if akin to a DDOS. How ironic.
- mike_d 3y agoIs it not working for you? I see over 350 active users at the moment. I did get one report that it was blocked by a corporate network because the domain was newly registered.
- Shakahs 3y agoThe Websocket connection did stop updating a few times when your site was getting the HN hug. You could push an updated list to Cloudflare KV every few seconds and have the front end poll it from there for cheap and near unlimited scalability.
- yonatan8070 3y agoI've seen people call this the "Hug of death" when your post gets so popular the site goes down
- psawaya 3y agoWhat about an actual user fat-fingering their username but entering their password correctly? Would this publish that attempt publicly?
- huy-nguyen 3y agoFrom the site: > No legitimate services are offered on the addresses receiving these attempts, so there is no chance of a real user accidently submitting their credentials.
- foobarbecue 3y agoWould be nice to have timestamps on these to get a feel for how fast they're coming in.
- wkat4242 3y agoIt's not that funny. While there may be millions of useless attempts, it only takes 1 to get through. Of course SSH has a great option in key / certificate auth. So if that's enforced it's not such a big deal. Many other systems don't (at least not until we finally implement Passkeys everywhere).
- nerdbert 3y agoIt's not a real ssh daemon; there's no "through" to get.
- KomoD 3y ago"Yes things other than SSH occasionally show up" Like what?
- FinalDestiny 3y agoI just saw an FTP one
- mike_d 3y agoHTTP/HTTPS basic auth, FTP/FTPS, LDAP, SSH, and a few other protocols are supported. I only show ones that actively try credentials, not just port scans.
- KomoD 3y agoInteresting!
- chlorion 3y agoI setup SSHD to listen on a wireguard interface rather than listening on all interfaces. This makes SSHD only accessible to wireguard peers rather than the entire internet. A nice aspect of wireguard is that it's "steath", meaning that it does not respond to unauthenticated connections at all, so there is no way to probe and scan for wireguard listeners at all. I think setting up daemons behind wireguard offers a lot of security. SSHD is probably fine to expose, but something like an IRC bouncer for example really benefits from being protected I think. I use ZNC over wireguard for this reason! It also allows to use ZNC securely without the need to setup TLS certs, which IME is actually harder than setting up wireguard!
- slim 3y agomaybe telnet over wireguard ? :)
- yonatan8070 3y agoThat just sounds like SSH with extra steps
- dtgriscom 3y ago... except that SSH isn't "stealth".
- yonatan8070 3y agoAh, I see what you mean now
- runeks 3y ago> A nice aspect of wireguard is that it's "steath", meaning that it does not respond to unauthenticated connections at all, so there is no way to probe and scan for wireguard listeners at all. I did not know this. That’s really cool. Is it done over a stateless protocol like UDP, or is a TCP connection opened first? Ie. is it impossible to see if there’s even a server there at all, or is it first revealed that there’s a server accepting a TCP connection?
- saulrh 3y agoKudos to 185.65.135.x, who attempted to log in with username hn_i_found_it right as I checked HN after work and opened the link, and who proceeded to attempt a number of different simple SQL, html, and js injections. I approve of this effort. I also approve of the author of this site, which appears to have survived this minor attack! :D
- deleted 3y ago[deleted]
- iaskedchatgpt 3y ago> HELLLOOO HACKER NEWS! Hi
- shadowgovt 3y agoIs hiding the last octet of the IP address really enough privacy?
- anticrymactic 3y agoDo these people deserve privacy?
- Dah00n 3y agoYes, because many are residential IPs, so likely hacked machines in a botnet.
- Timber-6539 3y agoI don't use password authentication and enforce fail2ban on all of my publicly accessible ssh servers. Even if someone was to steal my keys or knock at my ssh servers with a zero-day, I will be alerted[0] of any successful login(s). [0] https://github.com/64mb/SLAT-ssh-login-alert-telegram https://github.com/64mb/SLAT-ssh-login-alert-telegram
- pabs3 3y agoIt is probably time for OpenSSH to deprecate and remove support for password based authentication.
- densekernel 3y agoWould be cool to see brute.success
- deleted 3y ago[deleted]
- steakscience 3y agoWould be cool to have another column true/false if that IP is a VPN IP
- MrGagi 3y agoIt's crazy how much bots can keep trying to enter, and this bot from China really keeps trying, fail2ban really saves our ass
- michaelcampbell 3y agoI was struck by the preponderance of Singapore. Why there?
- Sami_Lehtinen 3y agoI guess you guys could find this also interesting: https://infosec.exchange/@rdpsnitch https://infosec.exchange/@rdpsnitch