Skip to content

Latest commit

 

History

History
57 lines (39 loc) · 2.04 KB

readme.md

File metadata and controls

57 lines (39 loc) · 2.04 KB
Raw

功能

  • php通过加载我们提供的log.php进行记录日志，包括request 和 response
  • 通过访问server.php获取日志，将日志存到数据库里面
  • 能够根据关键字进行搜索，可指定搜索请求头或者想要
  • 能够根据ip，uri，等进行过滤
  • 根据正则进行概率计算进而匹配攻击类型
  • 运用机器学习检测异常流量
  • 根据日志获取重放脚本

目前存在的问题

  • 如何收集更准确的规则

  • 如何确定每个规则对应的概率

  • server.php

获取最新的日志文件并且，以json的格式返回

  • log.php

存储日志的

  • log/show

显示日志内容

[{"model": "log.log", "pk": 1, "fields": {"attackip": "127.0.0.1", "attacktime": "2018-09-16T14:20:02Z", "method": "post", "uri": "/debug.php", "headers": "{'Host': '127.0.0.1', 'Accept-Encoding': 'gzip, deflate', 'Connection': 'keep-alive', 'User-Agent': 'python-requests/2.9.1', 'Accept': '*/*'}", "data": "system=xxx&xindong=ls", "response": "2018-09-21 07:12:51.727974+00:00"}}, {"model": "log.log", "pk": 2, "fields": {"attackip": "127.0.0.1", "attacktime": "2018-09-16T14:19:58Z", "method": "post", "uri": "/debug.php", "headers": "{'Host': '127.0.0.1', 'User-Agent': 'python-requests/2.9.1', 'Connection': 'keep-alive', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*'}", "data": "system=xxx&xindong=ls", "response": "2018-09-21 07:12:51.727974+00:00"}}]
  • log/update

从日志服务器上更新日志

  • log/replay?id=1

获取重放脚本

import requests

def replay():
    url = "http://127.0.0.1/debug.php"
    headers = {}
    headers["Content-Type"] = "application/x-www-form-urlencoded"
    tmp = {'Host': '127.0.0.1', 'Accept-Encoding': 'gzip, deflate', 'Connection': 'keep-alive', 'User-Agent': 'python-requests/2.9.1', 'Accept': '*/*'}
    for key in tmp:
        headers[key] = tmp[key]

    data = """system=xxx&xindong=ls"""
    r = requests.post(url, data=data, headers=headers, timeout=5)

    return r.text


if __name__ == "__main__":
    print(replay())