mcpField
A
analyzing-web-server-logs-for-intrusion

analyzing-web-server-logs-for-intrusion

github.com/mukul975Security35.2k411 installsUpdated 8w ago
Repository

About analyzing-web-server-logs-for-intrusion

A security-analysis skill for examining Apache and Nginx access logs for signs of intrusion. It guides security analysts through parsing requests, applying detection rules, enriching findings with GeoIP, and producing a prioritized report.

Key features

  1. 01Apache and Nginx log parsing
  2. 02SQL injection and traversal detection
  3. 03Scanner and brute-force detection
  4. 04GeoIP enrichment
  5. 05Prioritized JSON reporting

Use cases

  1. 01Investigating suspected web-server intrusions
  2. 02Building log-based detection rules
  3. 03Hunting for scanner and brute-force activity

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-web-server-logs-for-intrusion

After installing, type/analyzing-web-server-logs-for-intrusionin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Analyzing Web Server Logs for Intrusion

When to Use

  • When investigating security incidents that require analyzing web server logs for intrusion
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Familiarity with security operations concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

  1. Install dependencies: pip install geoip2 user-agents
  2. Collect web server access logs in Combined Log Format (Apache) or Nginx default format.
  3. Parse each log entry extracting: IP, timestamp, method, URI, status code, response size, user-agent, referer.
  4. Apply detection rules:
    • SQL injection: UNION SELECT, OR 1=1, ' OR ', hex encoding patterns
    • LFI/Path traversal: ../, /etc/passwd, /proc/self, php://filter
    • XSS: <script>, javascript:, onerror=, onload=
    • Scanner signatures: nikto, sqlmap, dirbuster, gobuster, wfuzz user-agents
    • Brute force: >50 POST requests to login endpoints from same IP in 5 minutes
  5. Enrich with GeoIP data and generate a prioritized findings report.
python scripts/agent.py --log-file /var/log/nginx/access.log --geoip-db GeoLite2-City.mmdb --output web_intrusion_report.json

Examples

Detect SQLi in URI
192.168.1.100 - - [15/Jan/2024:10:30:45 +0000] "GET /products?id=1' UNION SELECT username,password FROM users-- HTTP/1.1" 200 4532
Scanner User-Agent Detection
Nikto/2.1.6, sqlmap/1.7, DirBuster-1.0-RC1, gobuster/3.1.0

Comments

Markdown supported