Kippo findings round two
Dec 28, 2014It's been over a month since I set up twelve Kippo hosts using my Ansible playbook, time to get some stats.
Total Login Attempts: 4279170
Total Unique IPs: 5439
Total Unique Passwords: 383182
Total Unique Usenames: 3577
Total Unique Files Downloaded: 28
And here's a pipal analysis.
Total entries = 4272225
Total unique entries = 389335
Top 10 passwords
admin = 5644 (0.13%)
123456 = 2747 (0.06%)
root123 = 2678 (0.06%)
password = 2290 (0.05%)
root = 2065 (0.05%)
a = 2040 (0.05%)
12345 = 1843 (0.04%)
1234 = 1786 (0.04%)
test = 1776 (0.04%)
qwer1234 = 1702 (0.04%)
Top 10 base words
admin = 33225 (0.78%)
root = 24654 (0.58%)
password = 19442 (0.46%)
p@ssw0rd = 9031 (0.21%)
abcd = 8728 (0.2%)
test = 8263 (0.19%)
qwer = 7892 (0.18%)
qwerty = 7126 (0.17%)
passw0rd = 5877 (0.14%)
huawei = 5111 (0.12%)
Password length (length ordered)
1 = 6312 (0.15%)
2 = 12630 (0.3%)
3 = 43981 (1.03%)
4 = 153416 (3.59%)
5 = 547446 (12.81%)
6 = 648606 (15.18%)
7 = 539789 (12.63%)
8 = 974358 (22.81%)
9 = 569520 (13.33%)
10 = 267102 (6.25%)
11 = 161711 (3.79%)
12 = 148559 (3.48%)
13 = 69732 (1.63%)
14 = 40858 (0.96%)
15 = 17935 (0.42%)
16 = 19200 (0.45%)
17 = 9996 (0.23%)
18 = 8157 (0.19%)
19 = 4947 (0.12%)
20 = 6558 (0.15%)
21 = 3270 (0.08%)
22 = 1720 (0.04%)
23 = 2486 (0.06%)
24 = 1849 (0.04%)
25 = 1462 (0.03%)
26 = 1209 (0.03%)
27 = 1642 (0.04%)
28 = 1014 (0.02%)
29 = 644 (0.02%)
30 = 881 (0.02%)
31 = 488 (0.01%)
32 = 2270 (0.05%)
33 = 211 (0.0%)
34 = 328 (0.01%)
35 = 213 (0.0%)
36 = 381 (0.01%)
37 = 171 (0.0%)
38 = 232 (0.01%)
39 = 68 (0.0%)
40 = 7 (0.0%)
41 = 64 (0.0%)
42 = 70 (0.0%)
43 = 39 (0.0%)
44 = 90 (0.0%)
45 = 77 (0.0%)
46 = 30 (0.0%)
47 = 20 (0.0%)
48 = 72 (0.0%)
49 = 90 (0.0%)
50 = 2 (0.0%)
51 = 75 (0.0%)
52 = 20 (0.0%)
54 = 14 (0.0%)
55 = 44 (0.0%)
56 = 14 (0.0%)
57 = 15 (0.0%)
58 = 31 (0.0%)
60 = 13 (0.0%)
62 = 15 (0.0%)
63 = 34 (0.0%)
70 = 48 (0.0%)
71 = 14 (0.0%)
81 = 38 (0.0%)
Password length (count ordered)
8 = 974358 (22.81%)
6 = 648606 (15.18%)
9 = 569520 (13.33%)
5 = 547446 (12.81%)
7 = 539789 (12.63%)
10 = 267102 (6.25%)
11 = 161711 (3.79%)
4 = 153416 (3.59%)
12 = 148559 (3.48%)
13 = 69732 (1.63%)
3 = 43981 (1.03%)
14 = 40858 (0.96%)
16 = 19200 (0.45%)
15 = 17935 (0.42%)
2 = 12630 (0.3%)
17 = 9996 (0.23%)
18 = 8157 (0.19%)
20 = 6558 (0.15%)
1 = 6312 (0.15%)
19 = 4947 (0.12%)
21 = 3270 (0.08%)
23 = 2486 (0.06%)
32 = 2270 (0.05%)
24 = 1849 (0.04%)
22 = 1720 (0.04%)
27 = 1642 (0.04%)
25 = 1462 (0.03%)
26 = 1209 (0.03%)
28 = 1014 (0.02%)
30 = 881 (0.02%)
29 = 644 (0.02%)
31 = 488 (0.01%)
36 = 381 (0.01%)
34 = 328 (0.01%)
38 = 232 (0.01%)
35 = 213 (0.0%)
33 = 211 (0.0%)
37 = 171 (0.0%)
44 = 90 (0.0%)
49 = 90 (0.0%)
45 = 77 (0.0%)
51 = 75 (0.0%)
48 = 72 (0.0%)
42 = 70 (0.0%)
39 = 68 (0.0%)
41 = 64 (0.0%)
70 = 48 (0.0%)
55 = 44 (0.0%)
43 = 39 (0.0%)
81 = 38 (0.0%)
63 = 34 (0.0%)
58 = 31 (0.0%)
46 = 30 (0.0%)
52 = 20 (0.0%)
47 = 20 (0.0%)
57 = 15 (0.0%)
62 = 15 (0.0%)
71 = 14 (0.0%)
54 = 14 (0.0%)
56 = 14 (0.0%)
60 = 13 (0.0%)
40 = 7 (0.0%)
50 = 2 (0.0%)
|
| |
||||
||||
||||
||||
||||
||||
||||
|||||
|||||
|||||
||||||||
||||||||
|||||||||||
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
000000000011111111112222222222333333333344444444445555555555666666666677
012345678901234567890123456789012345678901234567890123456789012345678901
One to six characters = 1412385 (33.06%)
One to eight characters = 2926530 (68.5%)
More than eight characters = 1345695 (31.5%)
Only lowercase alpha = 1863480 (43.62%)
Only uppercase alpha = 14447 (0.34%)
Only alpha = 1877927 (43.96%)
Only numeric = 506595 (11.86%)
First capital last symbol = 25208 (0.59%)
First capital last number = 84459 (1.98%)
Months
january = 386 (0.01%)
february = 161 (0.0%)
march = 1091 (0.03%)
april = 1062 (0.02%)
may = 2603 (0.06%)
june = 948 (0.02%)
july = 624 (0.01%)
august = 1592 (0.04%)
september = 523 (0.01%)
october = 797 (0.02%)
november = 487 (0.01%)
december = 685 (0.02%)
Days
monday = 154 (0.0%)
tuesday = 63 (0.0%)
wednesday = 37 (0.0%)
thursday = 16 (0.0%)
friday = 195 (0.0%)
saturday = 9 (0.0%)
sunday = 133 (0.0%)
Months (Abreviated)
jan = 5789 (0.14%)
feb = 517 (0.01%)
mar = 35327 (0.83%)
apr = 2128 (0.05%)
may = 2603 (0.06%)
jun = 4579 (0.11%)
jul = 2372 (0.06%)
aug = 2962 (0.07%)
sept = 928 (0.02%)
oct = 2328 (0.05%)
nov = 2693 (0.06%)
dec = 2327 (0.05%)
Days (Abreviated)
mon = 22270 (0.52%)
tues = 63 (0.0%)
wed = 2056 (0.05%)
thurs = 152 (0.0%)
fri = 3870 (0.09%)
sat = 3037 (0.07%)
sun = 7538 (0.18%)
Includes years
1975 = 7620 (0.18%)
1976 = 6648 (0.16%)
1977 = 7440 (0.17%)
1978 = 6334 (0.15%)
1979 = 5982 (0.14%)
1980 = 7467 (0.17%)
1981 = 8545 (0.2%)
1982 = 6424 (0.15%)
1983 = 7833 (0.18%)
1984 = 8592 (0.2%)
1985 = 9117 (0.21%)
1986 = 9103 (0.21%)
1987 = 8716 (0.2%)
1988 = 8862 (0.21%)
1989 = 8256 (0.19%)
1990 = 8004 (0.19%)
1991 = 6658 (0.16%)
1992 = 7141 (0.17%)
1993 = 5816 (0.14%)
1994 = 4754 (0.11%)
1995 = 3422 (0.08%)
1996 = 2810 (0.07%)
1997 = 2752 (0.06%)
1998 = 1573 (0.04%)
1999 = 1246 (0.03%)
2000 = 5166 (0.12%)
2001 = 1996 (0.05%)
2002 = 1868 (0.04%)
2003 = 2340 (0.05%)
2004 = 1701 (0.04%)
2005 = 2257 (0.05%)
2006 = 2343 (0.05%)
2007 = 3440 (0.08%)
2008 = 10383 (0.24%)
2009 = 5993 (0.14%)
2010 = 8890 (0.21%)
2011 = 7946 (0.19%)
2012 = 7987 (0.19%)
2013 = 7515 (0.18%)
2014 = 2895 (0.07%)
2015 = 282 (0.01%)
2016 = 55 (0.0%)
2017 = 106 (0.0%)
2018 = 315 (0.01%)
2019 = 164 (0.0%)
2020 = 1491 (0.03%)
Years (Top 10)
2008 = 10383 (0.24%)
1985 = 9117 (0.21%)
1986 = 9103 (0.21%)
2010 = 8890 (0.21%)
1988 = 8862 (0.21%)
1987 = 8716 (0.2%)
1984 = 8592 (0.2%)
1981 = 8545 (0.2%)
1989 = 8256 (0.19%)
1990 = 8004 (0.19%)
Single digit on the end = 316111 (7.4%)
Two digits on the end = 209828 (4.91%)
Three digits on the end = 334071 (7.82%)
Last number
0 = 117432 (2.75%)
1 = 345257 (8.08%)
2 = 169506 (3.97%)
3 = 371406 (8.69%)
4 = 138993 (3.25%)
5 = 103643 (2.43%)
6 = 145253 (3.4%)
7 = 86214 (2.02%)
8 = 94345 (2.21%)
9 = 94860 (2.22%)
|
| |
| |
| |
| |
| |
| |
| |
|||
||| |
||||| |
||||||| ||
||||||||||
||||||||||
||||||||||
||||||||||
0123456789
Last digit
3 = 371406 (8.69%)
1 = 345257 (8.08%)
2 = 169506 (3.97%)
6 = 145253 (3.4%)
4 = 138993 (3.25%)
0 = 117432 (2.75%)
5 = 103643 (2.43%)
9 = 94860 (2.22%)
8 = 94345 (2.21%)
7 = 86214 (2.02%)
Last 2 digits (Top 10)
23 = 276777 (6.48%)
12 = 81583 (1.91%)
56 = 74550 (1.74%)
34 = 57127 (1.34%)
21 = 49045 (1.15%)
11 = 35517 (0.83%)
01 = 33071 (0.77%)
45 = 28208 (0.66%)
10 = 26189 (0.61%)
88 = 25548 (0.6%)
Last 3 digits (Top 10)
123 = 265326 (6.21%)
456 = 71517 (1.67%)
234 = 54518 (1.28%)
321 = 36337 (0.85%)
345 = 22703 (0.53%)
789 = 13743 (0.32%)
111 = 10952 (0.26%)
000 = 10466 (0.24%)
008 = 9827 (0.23%)
567 = 8697 (0.2%)
Last 4 digits (Top 10)
3456 = 66043 (1.55%)
1234 = 52626 (1.23%)
2345 = 21987 (0.51%)
3123 = 16998 (0.4%)
4321 = 10069 (0.24%)
2008 = 8546 (0.2%)
6789 = 8269 (0.19%)
4567 = 8255 (0.19%)
1111 = 6866 (0.16%)
2010 = 6826 (0.16%)
Last 5 digits (Top 10)
23456 = 65640 (1.54%)
12345 = 21703 (0.51%)
23123 = 16174 (0.38%)
56789 = 7955 (0.19%)
34567 = 7948 (0.19%)
45678 = 6124 (0.14%)
54321 = 5940 (0.14%)
11111 = 4840 (0.11%)
67890 = 2766 (0.06%)
23654 = 2719 (0.06%)
Character sets
loweralpha: 1863480 (43.62%)
loweralphanum: 1145890 (26.82%)
numeric: 506595 (11.86%)
loweralphaspecialnum: 174208 (4.08%)
loweralphaspecial: 128119 (3.0%)
mixedalpha: 122253 (2.86%)
mixedalphanum: 112280 (2.63%)
mixedalphaspecialnum: 67020 (1.57%)
specialnum: 41275 (0.97%)
special: 24563 (0.57%)
mixedalphaspecial: 23892 (0.56%)
upperalphanum: 17482 (0.41%)
upperalpha: 14447 (0.34%)
upperalphaspecial: 13500 (0.32%)
upperalphaspecialnum: 10603 (0.25%)
Character set ordering
allstring: 2000180 (46.82%)
stringdigit: 923976 (21.63%)
alldigit: 506595 (11.86%)
othermask: 417041 (9.76%)
stringdigitstring: 86055 (2.01%)
digitstring: 79982 (1.87%)
stringspecialdigit: 68912 (1.61%)
stringspecial: 68030 (1.59%)
stringspecialstring: 49227 (1.15%)
digitstringdigit: 27009 (0.63%)
allspecial: 24563 (0.57%)
specialstring: 13165 (0.31%)
specialstringspecial: 7490 (0.18%)
Hashcat masks (Top 10)
?l?l?l?l?l: 441911 (10.34%)
?l?l?l?l?l?l: 324026 (7.58%)
?l?l?l?l?l?l?l?l: 311103 (7.28%)
?l?l?l?l?l?l?l: 283900 (6.65%)
?d?d?d?d?d?d?d?d: 219536 (5.14%)
?l?l?l?l?l?l?l?l?l: 190302 (4.45%)
?d?d?d?d?d?d: 130232 (3.05%)
?l?l?l?l: 88982 (2.08%)
?l?l?l?l?l?l?l?l?l?l: 87274 (2.04%)
?l?l?l?l?l?l?d?d: 66208 (1.55%)
Tags: honeypot software security
