Keeping up with Web Logs. AWStats Supports HTTP as well as FTP and Mail logs IIS and Apache ...
-
Upload
vivien-delilah-ward -
Category
Documents
-
view
217 -
download
0
Transcript of Keeping up with Web Logs. AWStats Supports HTTP as well as FTP and Mail logs IIS and Apache ...
AWSTATS LOG ANALYZERKeeping up with Web Logs
AWStats
Supports HTTP as well as FTP and Mail logs IIS and Apache Complete list at end of presentation
Runs on Windows and Linux System Requirements
PERL 5.0 or greater
Useful Features
Summary of # visitors, # visits, pages, hits, bandwidth
Monthly, Daily, and Hourly traffic graphs Visitors listed by frequency Counts: file type, downloads, and URL-pages Status code counts
Link to view 404 Not-Found log entries Useful Plug-ins
Hostinfo Raw Log Search
Screenshot
Daily Trend
Top Visitors
Downloads
URLs Visited
HTTP Status Codes
404 Report
Hostinfo Plugin
Used to get Whois information about visitor
Will display information in a new browser window
Useful to determine origin of unresolvable Ips
Ex: 121.254.193.202 had over 1,500 hits to our site
Click on ? Link in the Hosts (Top 10) table
Hostinfo Plugin - Whois
Raw Log Search Plugin
Puts search form at top of report page
Will search and display contents of the “current” log
Allows PERL regular expression searches
Useful to search for suspicious traffic
Search for visitors…
Error codes…
Suspicious patterns…
More suspicious patterns
Caveat Emptor!
XSS attacks will be reflected in log!
•Don’t have other sites open using same browser
•Use dedicated system/vm for log review
Why I like it
It’s Free! Active project = revisions and
improvements Multi-platform support Easy to set up and get going Provides at-a-glance view of web
activity Plugins available to provide
additional functionality
Notes
Log formats supported Apache common log format (see Note*),
Apache combined log format (known as NCSA combined log format or XLF or ELF format),Any other personalized Apache log format,Any IIS log format (known as W3C format),Webstar native log format,Realmedia server, Windows Media Server, Darwin streaming server,ProFTPd server, vsFTPd server,Postfix, Sendmail, QMail, MdaemonA lot of web/wap/proxy/streaming servers log format
Notes - continued
Search pattern for visitor 123.125.67.181.*08/Jan
Search for error codes “ 400 “
Search for suspicious patterns URL w/ at least 4 encoded chars
GET.*(%[0-9a-fA-F]{2}){4}\S* HTTP Embedded hex
GET \S*(\\[xX][0-9a-fA-F]{2}) Reverse directory traversal
GET \S*(\.\.\/){2} Injection attacks
GET \S*(select\(|SELECT\(|--|1=1|\/\*|\|)
References
AWStats Home http://awstats.sourceforge.net http://
awstats.sourceforge.net/docs/index.html ASCII Table
http://www.asciitable.com/ Injection attack patterns
http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/