Lion Cipher Lab
Detect a brute-force login attempt in your logs
- SOC Analyst / Blue Team
- Beginner
- ~30 min
- Free · no account required
Why it matters
A brute-force attack is one of the oldest and most common threats on the internet: software guessing username and password combinations over and over until one works. Every login attempt, success or failure, leaves a line in the log — so a defender does not have to catch the attack live, they can read it afterwards in the record. Being able to isolate the failed logins, count how many came from each source, and recognise the tell-tale shape of an automated attack is a genuine day-one skill on a SOC (Security Operations Centre) team. And because it is all reading, it is one of the safest,…
What you'll learn
- reading auth logs
- grep filtering
- awk field extraction
- counting with sort and uniq
- recognising brute-force patterns
- basic SSH hardening
Steps in this lab
- Where failed logins are written down
- Isolate the failed logins with grep
- Read one failure line — the three fields that matter
- Count the attempts per source IP
- Recognise the brute-force signature
- Cross-check the same events with journalctl
- Shut the door — beginner defenses
- Why counting beats reading