less -S ftp.log 
Copy

in zeek if we have any field related to password zeek won't show it.

Editting /usr/local/zeek/share/zeek/base/protocols/ftp/main.zeek:

deleted the password line which had <hiddedn> term written in the script and then again i ran

zeek -C -r Capture.pcap local
Copy

now we can see the passwords.

root@53ef41d5da39:/mnt# cat ftp.log | zeek-cut user password | sort | uniq -c | sort -n
      6 tony.shephard   Summer2023!
     41 abdullah.yasin  XhlhGame_90HJLDASxfd&hoooad

Copy

another edit in the ftp/main.zeek to see the wrong passwords used by attacker

cat ftp.log | zeek-cut user password | sort | uniq -c | sort -n
Copy

not we can see the password spray

cat ftp.log | zeek-cut id.orig_h | sort | uniq -c | sort -n   
Copy

3.109.209.43
120.78.199.189
Copy

root@53ef41d5da39:/mnt# grep 120.78.199.189 *.log | awk -F: '{print $1}' | sort -n | uniq -c
    932 conn.log
    930 ftp.log

Copy

root@53ef41d5da39:/mnt# grep 3.109.209.43 *.log | awk -F: '{print $1}' | sort -n | uniq -c
  65641 conn.log
      3 dns.log
     34 files.log
    191 ftp.log
      2 ssh.log

Copy