Forum firewall report?

[Sharingan_Okami]

Hi,

Is there any scripts out there that can produce a firewall text report like this picture below?



I'v seen this work on a vbulletin forum i came across and searched for tutorials but cannot find anything.

Any help is appreciated

[Sharingan_Okami]

Anyone?

[ForceHSS]

A link to where you got the info might help

[squidsk]

I saw similar to that on a site where an admin account got compromised (with faq editing permissions) and an faq entry was changed. Similar urls were being used to attempt to retrieve information from the server.

faq.php?c=system(%24_GET%5B%27x%27%5D)%3B&faq=vb3_reading_posting&x=cat%20includes%2Fconfig.php

That's straight from the access logs.

[kh99]

There are tools out there which will process the web server access log to look for things like that. If you google for it you'll find a number of them. I suppose you could get something to work within vbulletin (if that's what you're asking for) by finding a source of the patterns that are matched to detect attacks, then applying them to the url whenever a vbulletin page is requested, and if there's a match put it in a log somehow.

But I don't know of anything like that that exists already, unless maybe one of the dbtech mods has that as a feature. I added it to my list of mod ideas, but the way things are going I don't know if or when I'd get around to it.