🛡️ Grit Firewall

Total attempts

–

Failed

–

Successful

–

Unique attacker IPs

–

Last seen (KST)

–

Attack trend

Top attacker IPs

Top targeted usernames

Login attempts — click any row for details

#	Time (KST)	Result	IP	Sessions	Country	City	ISP	Host (rDNS)	User	Method	Port

All attacker IPs — ranked by session count · click any row for full profile

#	IP address	Country	Total	Failed	Success	Flags	ISP / network	Last seen (UTC)

⚠ Application-layer compromise — attacker gets ROOT via the Next.js frontend, not SSH

A single unauthenticated POST with a Next-Action header + prototype-pollution body (__proto__:then / constructor:constructor) reaches the JS Function constructor and runs code inside the Node process. Because pm2 runs the app as root, that is instant root-level RCE — no SSH, no password, no escalation. Full write-up: 5.Audit/05-nextjs-rce-compromise.md.

RCE artifacts recorded

–

Still active

–

Critical severity

–

Removed / mitigated

–

Last observed (KST)

–

RCE attack chain & indicators — click any row for full detail

#	Status	Severity	Kill-chain	Indicator	Technique	Target	Time (KST · to the second)

🔒 System — password required

Enter the password to open the System area (captured credentials + live sessions).

SYSTEM

🔓 Captured Passwords

🟢 Live Sessions

🔑 pwd-history

🚫 Ban

⌨️ Keyboard

Credentials captured

–

Unique passwords

–

Unique IPs

–

Last capture (KST)

–

Most-tried passwords

Most-tried usernames

Captured login attempts — real passwords attackers sent

#	Time (KST)	IP	Country	Username	Password	SSH client	ISP	Flags

IPs currently INSIDE the VPS — successfully joined & live –

Only IPs that authenticated successfully into the real server and still hold a live connection. Failed logins, honeypot probes, and brute-force noise are excluded — these are real, active accesses only. (Confirmed via an SSH “Accepted” auth event matched to a live connection.)

IPs joined (live)

–

Live sessions total

–

Successfully joined — live sessions (click a row for the full IP profile)

Status	IP address	User	Auth	Location	ISP / network	Reverse DNS	🛡️ DNS origin	Login	Duration	Sessions

🔑 Password change history — this VPS

Change events are timestamped password changes recorded by PAM in the system journal (who was changed & when). Accounts shows each account's last password-change date from /etc/shadow. No password or hash is ever shown.

Change events logged

–

Accounts with a password

–

Password change events (newest first)

#	Time	Account changed	Via	PID

Accounts — last password change (from /etc/shadow)

Account	Password set?	Last change	Days ago

🚫 fail2ban — banned IP addresses

IPs fail2ban has blocked for repeated failed SSH logins. Active = ban currently enforced in the firewall right now · Expired = ban has since lifted (bantime elapsed). Click a row for the full IP profile.

Active bans (right now)

–

Banned in history

–

Total bans (jail)

–

Banned IPs — active first, then history

Status	IP address	Jail	Times banned	Last ban	Location	ISP / network	Reverse DNS	🛡️ DNS origin

⌨️ Grit Firewall — keyboard capture

Typing segments reported by Grit Firewall desktop clients (the .exe, 4.Firewall/firewall-grit). Each segment is a burst of keystrokes attributed to the foreground application that received them, with the captured text, character/keystroke counts and backspaces. A client delivers here when its backendUrl points at this dashboard. SIM = simulated sample (non-Windows / demo), not a real capture.

Segments

–

Characters typed

–

Keystrokes

–

Applications

–

Clients

–

By application

Application	Segments	Chars	Keys

Reporting clients

Client IP	Segments	Last seen

Captured typing — newest first

Reveal captured text

Time (local)	Application	Captured text	Chars	Keys	⌫	Client

🛡️ Grit Firewall

Attack trend

Top attacker IPs

Top targeted usernames

Login attempts — click any row for details

All attacker IPs — ranked by session count · click any row for full profile

⚠ Application-layer compromise — attacker gets ROOT via the Next.js frontend, not SSH

RCE attack chain & indicators — click any row for full detail

🔒 System — password required

Most-tried passwords

Most-tried usernames

Captured login attempts — real passwords attackers sent

IPs currently INSIDE the VPS — successfully joined & live –

Successfully joined — live sessions (click a row for the full IP profile)

🔑 Password change history — this VPS

Password change events (newest first)

Accounts — last password change (from /etc/shadow)

🚫 fail2ban — banned IP addresses

Banned IPs — active first, then history

⌨️ Grit Firewall — keyboard capture

By application

Reporting clients

Captured typing — newest first

By country

Top ISPs / networks

Attempts per day (last 30 days) — UTC+9

Attack trend Last 24h Last 30d

Top attacker IPs

Top targeted usernames

Login attempts — click any row for details

All attacker IPs — ranked by session count · click any row for full profile

⚠ Application-layer compromise — attacker gets ROOT via the Next.js frontend, not SSH

RCE attack chain & indicators — click any row for full detail

🔒 System — password required

Most-tried passwords

Most-tried usernames

Captured login attempts — real passwords attackers sent

IPs currently INSIDE the VPS — successfully joined & live –

Successfully joined — live sessions (click a row for the full IP profile)

🔑 Password change history — this VPS

Password change events (newest first)

Accounts — last password change (from /etc/shadow)

🚫 fail2ban — banned IP addresses

Banned IPs — active first, then history

⌨️ Grit Firewall — keyboard capture

By application

Reporting clients

Captured typing — newest first

By country

Top ISPs / networks

Attempts per day (last 30 days) — UTC+9

—

Attack trend