Scalp: Log Analyzer Finds Web Attacks

Sep 17, 2008

Romain Gaucher, a specialist in web security, offers his Scalp tool in version 0.4. The log analyzer searches for attacks on Apache web applications.

Scalp’s Python script uses regular expressions of the PHP Intrusion Detection System (PHPIDS) project that monitors attacks on PHP applications. Methods used include cross-site scripting (XSS), cross-site request forgery (CSRF) and SQL injection. Because the Apache web server in its standard form does not employ POST request variables, it can detect only GET request attacks.

The tool outputs its results as a report in text, XML or HTML format (here an example).

Scalp can sort its search results by type of attack, as a formatted HTML page.

In its standard form, the script can handle Apache logs of more than 100 megabytes without a problem, according to Gaucher. Limiting the analysis to a timeframe and a particular type of attack can further reduce the search time for large data sets. The program also allows spot checks in large log files.

The tool consists of a single Python script. Users will also need to download a default filter file. Both are available on the project home page.

Romain Gaucher is currently working on a C++ version of his program.

Related content

  • Security Lessons

    Sometimes, even ING, YouTube, The New York Times, and Google get it wrong.

    more »
  • XSA Attack

    A new form of phishing attack deposits an HTML tag on the vulnerable service to trap users into authenticating.

    more »
  • Static Code Analyzers

    Admins daily use scripts to automate tasks, generate web content, collect and parse data, and perform many other tasks. A few sophisticated tools can tell admins where script problems lurk.

    more »
  • ARP Spoofing Attacks

    ARP spoofing can be used to initiate denial-of-service attacks, network hijacking, and man-in-the-middle attacks on the Intranet. We look at how to prevent these incursions.

    more »
  • Hiawatha

    Many webmasters believe Apache is too fat and difficult. Hiawatha is a web server alternative with speed, simplicity, and some interesting security functions.

    more »
comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News

Tag Cloud

Administration Community Events Hardware Linux Linux Pro Magazine Mobile Programming Security Software Ubuntu Web Development Windows free software open source