Skip to content
SudoSecurity

Sections

securitymedium

Brute-Force Report

175 points · 0 solved

Every line of input is an auth log entry:

2026-11-02T10:00:01Z sshd FAIL user=root ip=203.0.113.5

The third field is OK or FAIL. Print every IP with 3 or more FAIL entries as ip count, sorted by count (highest first), then by IP as a plain string. If no IP qualifies, print NONE.

Example 1 input

2026-11-02T10:00:01Z sshd FAIL user=root ip=203.0.113.5
2026-11-02T10:00:02Z sshd FAIL user=root ip=203.0.113.5
2026-11-02T10:00:03Z sshd OK user=traven ip=198.51.100.7
2026-11-02T10:00:04Z sshd FAIL user=admin ip=203.0.113.5
2026-11-02T10:00:05Z sshd FAIL user=admin ip=198.51.100.7

Expected output

203.0.113.5 3
Learn the technique/labs/log-forensics

main.py