chapinb

"""Quick script to open a text file of Google search URL query strings 
and extract the typed search values.


Copyright 2018 Chapin Bryce.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

chapinb

# $1 = file to parse
# $2 = file to write to
cat $1 | python -c 'import sys, base64; data=sys.stdin.read(); print base64.urlsafe_b64decode(data+"="*(4-len(data)%4))' > $2

chapinb

$ man ls

LS(1)                     BSD General Commands Manual                    LS(1)

NAME
     ls -- list directory contents

SYNOPSIS
     ls [-ABCFGHLOPRSTUW@abcdefghiklmnopqrstuwx1] [file ...]

chapinb

$ fgrep "Accepted publickey" auth.log
Sep 29 18:49:39 tracker sshd[12509]: Accepted publickey for root from 209.151.35.27 port 32852 ssh2: RSA SHA256:+EQAdisZCdb274cIdoykPH9p5DAL/VUHLsiNm63eSiM
Sep 29 18:50:17 tracker sshd[12580]: Accepted publickey for root from 209.151.35.27 port 36726 ssh2: RSA SHA256:+EQAdisZCdb274cIdoykPH9p5DAL/VUHLsiNm63eSiM

chapinb

$ fgrep Invalid\ user auth.log | head -n 5
Sep 24 06:27:11 tracker sshd[29197]: Invalid user babs from 188.165.201.89
Sep 24 06:27:13 tracker sshd[29199]: Invalid user hostmaster from 180.211.137.8
Sep 24 06:30:10 tracker sshd[29265]: Invalid user prova from 188.165.201.89
Sep 24 06:30:45 tracker sshd[29267]: Invalid user contact from 180.211.137.8
Sep 24 06:34:20 tracker sshd[29269]: Invalid user contact from 180.211.137.8

chapinb

$ fgrep Invalid\ user auth.log | head -n 5 | awk '{ print $10 }' 188.165.201.89
180.211.137.8
188.165.201.89
180.211.137.8
180.211.137.8

chapinb

$ fgrep Invalid\ user auth.log | head -n 5 | awk '{ print $10 }' | sort | uniq -c | sort -rn
   3 180.211.137.8
   2 188.165.201.89

chapinb

alias usort='sort | uniq -c | sort -n'  # Normal sort
alias ursort='sort | uniq -c | sort -rn'  # Reverse sort

chapinb

$ fgrep Invalid\ user auth.log | head -n 5 | awk '{ print $10 }' | ursort
   3 180.211.137.8
   2 188.165.201.89

chapinb

{
  "query_seconds": 0.114051,
  "records": {
    "13.52.4.25": {
      "message": "",
      "results": [
        {
          "cidr": "13.52.0.0/16",
          "first_collected": "2017-09-08T16:27:01",
          "last_collected": "2019-01-13T08:00:01",