One ibl Log Analysis

Source: Internet
Author: User

In the past few attempts to get a honeypot, the hacker's method of hacking into the website is to collect 0-day data. This time I decided to come to a great god. I won't talk about the day. It's about dz. I guess I'm still analyzing it when I write this article. 0x1: What is an ibl log? As far as I know, there are two types of IIS log file formats: one is ibl, the former is what we usually encounter with tools for analysis. The latter is the binary file format that needs to be converted using tools. The latter has the advantage of consuming less space, when there are many sites with a particularly high access volume every day, we can reduce our usage of storage space. 0x2: When will the log format be converted to ibl by default when we first set up iis services, and when will the log format be converted to ibl inadvertently? Here, I used to write logs in the log format. Later I checked the iis extension service before, once installed, the installation package for automatic configuration of PHP5.2.17 will convert our default log format to ibl, And the iis logs for off-star virtual hosts are also the same. 0x3: iis log format conversion 1. find the file address: In system32 \ metabase. xml file 2. open this file in notepad and find the CentralBinaryLoggingEnabled field. if this field is TRUE, it should be changed to FALSE, 3. iisreset restart IIS 0x4: Log Parser 2.2 is the tool used for ibl format Log file conversion. You can download it here. http://www.xinyues.org/thread-965-1-1.html Always install it by default. Next, convert the specified ibl file to a log file. First, find the iis identifier of the corresponding website. Here, 986744415 is the identifier of the website. Command: 1 C: \ Program Files \ Log Parser 2.2> logparser "select * into log1.txt from C: \ IISLog Files \ W3SVC \ ra130524.ibl where siteid = 986744415" means to set the identifier to C in the 986744415 path: \ IISLog Files \ W3SVC \ ra130524.ibl all content is converted to "log" format and saved to the current directory. We can compare the size of the two Files to see that the benefits of ibl Files occupy less space. half. The content format shown in the file content is different from that stored in the original log format. Therefore, the analysis of iis log behavior analysis tools on the Internet fails. 0x4: Write tool analysis iis log behavior analysis tool principle: import the file to search for the feature string and then analyze it. Complex log analysis tools are also based on this principle. As a half-hanging php rookie script, of course, it is difficult to make up. Paste code 01 <? Php 02 export a1_file('log1.txt '); 03 $ B = "fuck2.txt"; 04 foreach ($ a as $ key => $ vale) {05 if (strpos ($ vale, '27. 202.82.212 ') & strpos ($ vale, 'post') {06 fwrite (fopen ($ B, 'a +'), $ vale. '\ n'); 07} 08 09} 10 11?> Check whether the query is simple. Search for two strings. Here we will check the data of the action with the ip address 27.202.82.212 request as post. You can also add multiple conditions! Because the requirements are different, I will basically be finished. Next, let's see what this ip address has done at a certain time.



-------- I'm cutover ------- 0x5: so far, this is the process from ignorance to familiarity with ibl logs to analysis.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.