25 أسطر
1.0 KiB
Python
25 أسطر
1.0 KiB
Python
import re
|
|
from collections import defaultdict
|
|
|
|
LOG_FILE = "ghaymah_access.log"
|
|
FAILED_THRESHOLD = 5
|
|
|
|
ip_failures = defaultdict(int)
|
|
|
|
log_pattern = re.compile(r'(?P<ip>\d+\.\d+\.\d+\.\d+) - - \[.*?\] "(?P<method>\w+) (?P<path>\S+) HTTP/.*?" (?P<status>\d{3})')
|
|
|
|
try:
|
|
with open(LOG_FILE, 'r') as f:
|
|
for line in f:
|
|
match = log_pattern.search(line)
|
|
if match:
|
|
data = match.groupdict()
|
|
if data['status'] == '401' and '/login' in data['path']:
|
|
ip_failures[data['ip']] += 1
|
|
if ip_failures[data['ip']] >= FAILED_THRESHOLD:
|
|
print(f"[ALERT] High Brute Force Risk: {data['ip']} ({ip_failures[data['ip']]} failed attempts)")
|
|
if "select" in data['path'].lower() or "union" in data['path'].lower():
|
|
print(f"[CRITICAL] Potential SQL Injection from {data['ip']}: {data['path']}")
|
|
except FileNotFoundError:
|
|
print(f"Log file {LOG_FILE} not found. Ready for deployment.")
|