a0s / access_log_fuzzing_detector

Scans access.log and detects fuzzing attempts.

Access.log Fuzzing Detector

Very simple (and stupid) scanner that able to detect attempts of fuzzing.

Features

• fast search in dictionary
• unlimited size of dictionary

Prerequisites

• ruby interpretator in PATH
• access.log should be in default nginx format
• downloaded fuzzing dictionary fuzz.txt (for example, you cat get it here, here, or here)

Usage

Send access.log to stdin, and scanner will return you suspicious requests to stdout. Use cat

cat access.log | ruby scanner fuzz.txt

or pv if you want to see overall progress/speed

pv access.log | ruby scanner fuzz.txt

How it works

Every input line in stdin will process by stages:

1. Parse request with regular expression. In case of failure it returns RegexpSucks exception :)
2. Check method of request. Allowed methods are GET HEAD POST PUT DELETE CONNECT OPTIONS TRACE PATCH
3. Check protocol of request. Allower protocols are HTTP/1.0 HTTP/1.1
4. For every line/from/dictionary we will check:
   • request_uri not start with line/from/dictionary
   • request_uri not start with /line/from/dictionary
   • request_uri not end with line/from/dictionary