Some Ideas about web server log analysis

Dark visitor blog

If a friend's website is infected with Trojans, the channel is nothing more than password leakage, operating system vulnerabilities, web server vulnerabilities, language parser vulnerabilities, database vulnerabilities, and application vulnerabilities. Because it is a virtual host, the first thing you can do is to find application vulnerabilities. To find this vulnerability, there are only three ways. One is to find the application's help record through the search engine, so that someone else can find a way to handle this kind of transaction, and then fix the vulnerability. One is to check the source code and find out the vulnerability. This is too feasible because there are tens of thousands of lines of source code. If there is no relevant experience, it is a dream to find the vulnerability. The last step is to analyze the web server logs, identify abnormal access, and then identify vulnerabilities.

I haven't analyzed things for a long time. I got a log and saw a few hundred million lines. I can't help but think about it later. It's nothing more than an ip address, access time, the access url and the identity information submitted by the visitor. First, find the characteristics of the search engine spider in the log, and then filter it out. It is best to maintain a feature information library so that the next time you analyze the log, you can easily pull it and finally retrieve the IP address, remove it, and then use the IP address to calculate the number of access logs for each address. If the access traffic is small, it can be ignored, and then grouped by time, after all, it is a relatively narrow time interval to be attacked and Trojan-infected. In the end, the access pages of some specific files are negligible. After all, some files cannot be Trojan-infected, the remaining URLs are suspicious access pulls. We write a script to repeat these URLs and write down the logs. We should quickly find the file where the vulnerability is located, at this time, the adjustment program based on input may quickly find the vulnerability.