Web服务器入侵日志分析
原名：analyzing-web-server-logs-for-intrusion
解析 Apache 和 Nginx 访问日志，检测 SQL 注入攻击尝试。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 1
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-20
- TRACE 评分
- 3.4 / 5
内容概览
- When investigating security incidents that require analyzing web server logs for intrusion - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques - Familiarity with security operations concepts and tools - Access to a test or lab environment for safe execution - Python 3.8+ with required dependencies installed - Appropriate authorization for any testing activities 1. Install dependencies: pip install geoip2 user-agents 2. Collect web server access logs in Combined Log Format (Apache) or Nginx default format. 3. Parse each log entry extracting: IP, timestamp, method, URI, status code, response size, user-agent, referer. 4. Apply detection rules: - SQL injection: UNION SELECT, OR 1=1, ' OR ', hex encoding patterns - LFI/Path…