[Python] Apache server log scanner for malicious activity

[sh4d0w_w4tch]

I made a simple script that scans an Apache log for strings that match possible malicious activity.  When designing the script in set the comparisons to be case insensitive so that it can't be bypassed by an attacker using random case.

https://gist.github.com/sh4d0w-w4tch/7b88ad6f55d5a3513b27

The script logs all suspected entries and records line numbers from previous times it has been run.  IP addresses of attackers are listed so they can be blocked if the scan terms are reliable.  Blocking is not built into the script because there are many ways of blocking IP addresses.

[TitanFury]

Wow thanks man!


I like this script a lot.

[kenjoe41]

Line 7, are you assigning the string to that variable or did you forget somehow to insert a prompt before the string?

I also think we should supply the log path from the commandline than just prompting the users. I think it would be better for the audience hat will use this script.
You are opening files everywhere, even though with different flags but it looks messy to me. I knoow quick dirty scripts don't have to be perfect but the risks of doing something wrong with my logs and i lose them accidentally.

Is that NOP a place holder in this instance or is it there for some other reason?

[sh4d0w_w4tch]

Line 7, are you assigning the string to that variable or did you forget somehow to insert a prompt before the string?

I also think we should supply the log path from the commandline than just prompting the users. I think it would be better for the audience hat will use this script.
You are opening files everywhere, even though with different flags but it looks messy to me. I knoow quick dirty scripts don't have to be perfect but the risks of doing something wrong with my logs and i lose them accidentally.

Is that NOP a place holder in this instance or is it there for some other reason?

Line 7 was going to be consistent, but I can change it to sys.argv[1].  I will improve the file opening.  I should have used pass instead of the NOP hex but I couldn't remember it.