Very simple (and stupid) scanner that able to detect attempts of fuzzing.
- fast search in dictionary
- unlimited size of dictionary
- ruby interpretator in PATH
- access.log should be in default nginx format
- downloaded fuzzing dictionary
fuzz.txt
(for example, you cat get it here, here, or here)
Send access.log to stdin, and scanner will return you suspicious requests to stdout. Use cat
cat access.log | ruby scanner fuzz.txt
or pv
if you want to see overall progress/speed
pv access.log | ruby scanner fuzz.txt
Every input line in stdin will process by stages:
- Parse request with regular expression. In case of failure it returns
RegexpSucks
exception :) - Check
method
of request. Allowed methods areGET HEAD POST PUT DELETE CONNECT OPTIONS TRACE PATCH
- Check
protocol
of request. Allower protocols areHTTP/1.0 HTTP/1.1
- For every
line/from/dictionary
we will check:request_uri
not start withline/from/dictionary
request_uri
not start with/line/from/dictionary
request_uri
not end withline/from/dictionary