| 47 | |
| 48 | |
| 49 | class log_analysis: |
| 50 | path = '/www/server/panel/script' |
| 51 | log_analysis_path = '/www/server/panel/script/log_analysis.sh' |
| 52 | logs_path = '/www/server/panel/logs/analysis/' |
| 53 | |
| 54 | def __init__(self): |
| 55 | if not os.path.exists(self.path + '/log/'): os.makedirs(self.path + '/log/') |
| 56 | if not os.path.exists(self.log_analysis_path): |
| 57 | log_analysis_data = '''help(){ |
| 58 | echo "Usage: ./action.sh [options] [FILE] [OUTFILE] " |
| 59 | echo "Options:" |
| 60 | echo "xxx.sh san_log [FILE] 获取成功访问请求中带有xss|sql|敏感信息|php代码执行 关键字的日志列表 [OUTFILE] 11" |
| 61 | echo "xxx.sh san [FILE] 获取成功访问请求中带有sql关键字的日志列表 [OUTFILE] 11 " |
| 62 | } |
| 63 | |
| 64 | if [ $# == 0 ] |
| 65 | then |
| 66 | help |
| 67 | exit |
| 68 | fi |
| 69 | |
| 70 | if [ ! -e $2 ] |
| 71 | then |
| 72 | echo -e "$2: 日志文件不存在" |
| 73 | exit |
| 74 | fi |
| 75 | |
| 76 | if [ ! -d "log" ] |
| 77 | then |
| 78 | mkdir log |
| 79 | fi |
| 80 | |
| 81 | echo "[*] Starting ..." |
| 82 | |
| 83 | if [ $1 == "san_log" ] |
| 84 | then |
| 85 | echo "1">./log/$3 |
| 86 | echo "开始获取xss跨站脚本攻击日志..." |
| 87 | |
| 88 | grep -E ' (200|302|301|500|444|403|304) ' $2 | grep -i -E "(javascript|data:|alert\(|onerror=|%3Cimg%20src=x%20on.+=|%3Cscript|%3Csvg/|%3Ciframe/|%3Cscript%3E).*?HTTP/1.1" >./log/$3xss.log |
| 89 | |
| 90 | echo "分析日志已经保存到./log/$3xss.log" |
| 91 | echo "扫描到攻击次数: "`cat ./log/$3xss.log |wc -l` |
| 92 | echo "20">./log/$3 |
| 93 | |
| 94 | |
| 95 | echo "开始获取sql注入漏洞攻击日志..." |
| 96 | echo "分析日志已经保存到./log/$3sql.log" |
| 97 | grep -E ' (200|302|301|500|444|403) ' $2 | grep -i -E "(from.+?information_schema.+|select.+(from|limit)|union(.*?)select|extractvalue\(|case when|extractvalue\(|updatexml\(|sleep\().*?HTTP/1.1" > ./log/$3sql.log |
| 98 | echo "扫描到攻击次数: "`cat ./log/$3sql.log |wc -l` |
| 99 | echo "40">./log/$3 |
| 100 | |
| 101 | echo -e "开始获取文件遍历/代码执行/扫描器信息/配置文件等相关日志" |
| 102 | grep -E ' (200|302|301|500|444|403) ' $2 | grep -i -E "(\.\.|WEB-INF|/etc|\w\{1,6\}\.jsp |\w\{1,6\}\.php|\w+\.xml |\w+\.log |\w+\.swp |\w*\.git |\w*\.svn |\w+\.json |\w+\.ini |\w+\.inc |\w+\.rar |\w+\.gz |\w+\.tgz|\w+\.bak |/resin-doc).*?HTTP/1.1" >./log/$3san.log |
| 103 | echo "分析日志已经保存到./log/$3san.log" |
| 104 | echo "扫描到攻击次数: "`cat ./log/$3san.log |wc -l` |
| 105 | echo "50">./log/$3 |
| 106 | |