Module Expr Str Import alias Import alias Import alias Import alias Import alias Import alias Import alias ImportFrom alias ImportFrom alias alias Import alias ClassDef bases AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr body FunctionDef arguments args NameParam NameParam defaults body Assign AttributeStore NameLoad attr Call AttributeLoad NameLoad attr Str Str Assign AttributeStore NameLoad attr Call AttributeLoad NameLoad attr Str Str Assign AttributeStore NameLoad attr Call NameLoad Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad AttributeLoad AttributeLoad AttributeLoad NameLoad attr attr attr attr NameLoad NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign AttributeStore NameLoad attr ListLoad decorator_list FunctionDef arguments args NameParam defaults body Pass decorator_list FunctionDef arguments args NameParam NameParam defaults body If BoolOpOr CompareEq SubscriptLoad NameLoad Index Str Str CompareEq SubscriptLoad NameLoad Index Str Str body Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr SubscriptLoad NameLoad Index Str Expr Call AttributeLoad AttributeLoad NameLoad attr attr Dict Str Str Str Str Str Str Call AttributeLoad Call AttributeLoad NameLoad attr attr Call AttributeLoad Call AttributeLoad NameLoad attr attr Str Call AttributeLoad NameLoad attr Str SubscriptLoad NameLoad Index Str SubscriptLoad NameLoad Index Str SubscriptLoad NameLoad Index Str If CompareGtE Call NameLoad AttributeLoad NameLoad attr AttributeLoad NameLoad attr body Assign NameStore AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr ListLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad If CompareGt Call NameLoad AttributeLoad NameLoad attr BinOpMult AttributeLoad NameLoad attr Num body Assign AttributeStore NameLoad attr SubscriptLoad AttributeLoad NameLoad attr Slice UnaryOpUSub AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Str Assign NameStore Str Assign NameStore Str For NameStore AttributeLoad NameLoad attr body AugAssignAdd NameStore Call AttributeLoad Str attr SubscriptLoad NameLoad Index Str SubscriptLoad NameLoad Index Str SubscriptLoad NameLoad Index Str SubscriptLoad NameLoad Index Str SubscriptLoad NameLoad Index Str SubscriptLoad NameLoad Index Str Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr Call AttributeLoad Call AttributeLoad NameLoad attr Call AttributeLoad Str attr NameLoad AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr AttributeLoad NameLoad attr attr Assign NameStore Call AttributeLoad Str attr NameLoad NameLoad AttributeLoad NameLoad attr Assign NameStore Dict Str Str Str NameLoad Str Call NameLoad NameLoad Expr Call AttributeLoad NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr keyword Str keyword Str keyword NameLoad keyword Num keyword NameLoad FunctionDef arguments args NameParam defaults body Assign NameStore NameLoad Assign NameStore AttributeLoad NameLoad attr If CompareEq AttributeLoad NameLoad attr AttributeLoad AttributeLoad NameLoad attr attr body Assign NameStore Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad NameLoad attr NameLoad If CompareIs NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Str Assign NameStore NameLoad Assign NameStore Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr NameLoad If CompareNotEq Call AttributeLoad NameLoad attr Num Call AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr Call AttributeLoad Str attr Call AttributeLoad NameLoad attr Num Call AttributeLoad NameLoad attr Assign NameStore NameLoad Assign NameStore Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad NameLoad attr NameLoad If CompareIs NameLoad NameLoad body Expr Call AttributeLoad NameLoad attr Str Assign NameStore NameLoad Assign NameStore Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr NameLoad If CompareNotEq Call AttributeLoad NameLoad attr Num Call AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr Call AttributeLoad Str attr Call AttributeLoad NameLoad attr Num Call AttributeLoad NameLoad attr Assign NameStore NameLoad Expr Call AttributeLoad NameLoad attr Call AttributeLoad Str attr Call NameLoad NameLoad orelse Expr Call AttributeLoad NameLoad attr Call AttributeLoad Str attr AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr Call AttributeLoad Str attr NameLoad Assign NameStore NameLoad If NameLoad body Expr Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr NameLoad decorator_list Expr Call AttributeLoad NameLoad attr NameLoad decorator_list decorator_list
N/A N/A 
Send SSH logins to SANS DShield.
See https://isc.sans.edu/ssh.html

 N/A dateutil.parser N/A time N/A base64 N/A hmac N/A hashlib N/A requests N/A re twisted.python log twisted.internet threads reactor N/A cowrie.core.output Output N/A N/A N/A N/A cowrie core output Output N/A __init__ N/A N/A self cfg N/A N/A N/A N/A self auth_key N/A N/A cfg get output_dshield auth_key N/A N/A self userid N/A N/A cfg get output_dshield userid N/A N/A self batch_size N/A int N/A N/A cfg get output_dshield batch_size N/A N/A N/A N/A N/A N/A cowrie core output Output __init__ self cfg N/A start N/A N/A self N/A N/A N/A N/A self batch N/A N/A stop N/A N/A self N/A N/A N/A N/A write N/A N/A self entry N/A N/A N/A N/A N/A N/A entry N/A eventid cowrie.login.success N/A N/A entry N/A eventid cowrie.login.failed N/A N/A date N/A N/A N/A dateutil parser parse N/A entry N/A timestamp N/A N/A N/A N/A self batch append N/A date time timezone source_ip user password N/A N/A N/A N/A date date __str__ N/A N/A N/A N/A date time strftime %H:%M:%S N/A N/A time strftime %z N/A entry N/A src_ip N/A entry N/A username N/A entry N/A password N/A N/A N/A len N/A self batch N/A self batch_size N/A N/A batch_to_send N/A self batch N/A N/A N/A self submit_entries batch_to_send N/A N/A self batch N/A N/A transmission_error N/A N/A self batch N/A N/A N/A N/A N/A N/A self batch extend batch N/A N/A N/A len N/A self batch N/A N/A self batch_size 2 N/A N/A N/A self batch N/A N/A self batch N/A N/A N/A self batch_size N/A submit_entries N/A N/A self batch N/A N/A N/A 
        Large parts of this method are adapted from kippo-pyshield by jkakavas
        Many thanks to their efforts. https://github.com/jkakavas/kippo-pyshield
         N/A _nonceb64 ElWO1arph+Jifqme6eXD8Uj+QTAmijAWxX1msbJzXDM= N/A log_output N/A attempt N/A self batch N/A N/A log_output N/A N/A {0}	{1}	{2}	{3}	{4}	{5}
 format N/A attempt N/A date N/A attempt N/A time N/A attempt N/A timezone N/A attempt N/A source_ip N/A attempt N/A user N/A attempt N/A password N/A nonce N/A N/A base64 b64decode _nonceb64 N/A digest N/A N/A base64 b64encode N/A N/A N/A N/A hmac new N/A N/A {0}{1} format nonce N/A self userid N/A N/A base64 b64decode N/A self auth_key N/A hashlib sha256 digest N/A auth_header N/A N/A credentials={0} nonce={1} userid={2} format digest _nonceb64 N/A self userid N/A headers N/A X-ISC-Authorization Content-Type Content-Length auth_header text/plain N/A len log_output N/A N/A N/A log msg headers N/A req N/A N/A threads deferToThread N/A requests request method PUT url https://secure.dshield.org/api/file/sshlog headers headers timeout 10 data log_output check_response N/A N/A resp N/A N/A N/A failed False N/A response N/A resp content N/A N/A N/A resp status_code N/A N/A requests codes ok N/A N/A sha1_regex N/A N/A re compile <sha1checksum>([^<]+)<\/sha1checksum> N/A sha1_match N/A N/A sha1_regex search response N/A N/A sha1_match None N/A N/A N/A N/A log err dshield ERROR: Could not find sha1checksum in response N/A failed True N/A sha1_local N/A N/A hashlib sha1 N/A N/A N/A sha1_local update log_output N/A N/A N/A N/A sha1_match group 1 N/A N/A sha1_local hexdigest N/A N/A N/A N/A log err N/A N/A dshield ERROR: SHA1 Mismatch {0} {1} . format N/A N/A sha1_match group 1 N/A N/A sha1_local hexdigest N/A failed True N/A md5_regex N/A N/A re compile <md5checksum>([^<]+)<\/md5checksum> N/A md5_match N/A N/A md5_regex search response N/A N/A md5_match None N/A N/A N/A N/A log err dshield ERROR: Could not find md5checksum in response N/A failed True N/A md5_local N/A N/A hashlib md5 N/A N/A N/A md5_local update log_output N/A N/A N/A N/A md5_match group 1 N/A N/A md5_local hexdigest N/A N/A N/A N/A log err N/A N/A dshield ERROR: MD5 Mismatch {0} {1} . format N/A N/A md5_match group 1 N/A N/A md5_local hexdigest N/A failed True N/A N/A N/A log msg N/A N/A dshield SUCCESS: Sent {0} bytes worth of data to secure.dshield.org format N/A len log_output N/A N/A N/A N/A log err N/A N/A dshield ERROR: error {0}. format N/A resp status_code N/A N/A N/A log err N/A N/A Response was {0} format response N/A failed True N/A failed N/A N/A N/A N/A reactor callFromThread N/A self transmission_error batch N/A N/A N/A N/A req addCallback check_response N/A N/A