# Weblog Attack Analyzer

Paste Apache, Nginx, or IIS access logs and flag SQLi, XSS, traversal, scanner user agents, sensitive probes, and high-volume offending IPs.

## Run it

- **CLI:** `gizza tool weblog-attack-analyzer '203.0.113.5 - - [11/Mar/2024:09:14:02 +0000] "GET /products.php?id=1%27+UNION+SELECT+null,version()--+- HTTP/1.1" 200 512 "-" "sqlmap/1.7"'`
- **Web:** https://gizza.ai/tools/weblog-attack-analyzer/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/weblog-attack-analyzer/tool.json

## Inputs

- `logs` — Access logs _(field)_
- `category` — Category filter _(field)_
- `min_severity` — Minimum severity _(field)_
- `output` — Output as _(field)_
- `offender_threshold` — High-volume threshold _(field)_
- `error_threshold` — 404 / auth-error threshold _(field)_
- `decode` — Decode percent-encoded payloads _(field)_
- `limit` — Finding limit _(field)_

## Output

- Analysis (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `logs` — Access logs
- `category` — Category filter
- `min_severity` — Minimum severity
- `output` — Output as
- `offender_threshold` — High-volume threshold
- `error_threshold` — 404 / auth-error threshold
- `decode` — Decode percent-encoded payloads
- `limit` — Finding limit

Example: `https://gizza.ai/tools/weblog-attack-analyzer/?logs=203.0.113.5%20-%20-%20%5B11%2FMar%2F2024%3A09%3A14%3A02%20%2B0000%5D%20%22GET%20%2Fproducts.php%3Fid%3D1%2527%2BUNION%2BSELECT%2Bnull%2Cversion%28%29--%2B-%20HTTP%2F1.1%22%20200%20512%20%22-%22%20%22sqlmap%2F1.7%22&category=all&min_severity=all&output=report&offender_threshold=20&error_threshold=5&decode=true&limit=500`

---

## What this tool does

Paste Apache, Nginx, or IIS access logs and this tool highlights requests that look like web-application attack traffic. It parses each request, percent-decodes the target once and twice, matches a curated set of signatures, and then rolls findings up by source IP so you can see both individual payloads and noisy offenders.

It flags these classes:

- **SQL injection** — `UNION SELECT`, tautologies, time-delay probes, `information_schema`, `xp_cmdshell`, and similar payloads.
- **XSS** — encoded or raw `<script>`, event handlers, `javascript:` URLs, SVG/iframe/img payloads, and cookie-stealing probes.
- **Traversal and file inclusion** — `../`, `/etc/passwd`, Windows paths, PHP stream wrappers, and remote include attempts.
- **RCE and scanner traffic** — Log4Shell/JNDI payloads, shell command markers, and user agents such as sqlmap, nikto, nuclei, wpscan, and masscan.
- **Sensitive-path probes** — `.env`, `.git`, `wp-login.php`, phpMyAdmin, Spring Actuator, server-status, and other common reconnaissance paths.

The report also calls out source IPs with high request volume, many 404s (enumeration), or repeated 401/403s (brute-force style behaviour). Use the **Blocklist** output when you just want one suspicious IP per line.

## Worked example

Paste this sample with **Output as: Report**:

```text
203.0.113.5 - - [11/Mar/2024:09:14:02 +0000] "GET /products.php?id=1%27+UNION+SELECT+null,version()--+- HTTP/1.1" 200 512 "-" "sqlmap/1.7"
203.0.113.5 - - [11/Mar/2024:09:14:05 +0000] "GET /admin/../../etc/passwd HTTP/1.1" 404 153 "-" "sqlmap/1.7"
198.51.100.22 - - [11/Mar/2024:09:14:20 +0000] "GET /search?q=%3Cscript%3Ealert(1)%3C/script%3E HTTP/1.1" 200 980 "-" "Mozilla/5.0"
```

The output starts with a compact caption such as:

```text
Weblog attack analysis · combined · 3 requests · 3 flagged · 2 source IPs
```

Then it lists categories by severity, ranks the top source IPs, and shows each finding with the line number, source IP, request target, status code, and matched signature names.

## Limits and edge cases

- This is a **heuristic triage tool**, not a WAF, IDS, or legal/security determination. It points you to suspicious requests to investigate.
- It parses Apache/Nginx common and combined logs plus IIS W3C logs with a `#Fields:` header. Other shapes should be normalized first with a log parser.
- Encoded payload detection is on by default. Turn **Decode percent-encoded payloads** off only when you need to compare raw matching behaviour.
- Source-IP aggregation uses the IP printed in the log. If your logs contain a reverse proxy address instead of the real client IP, normalize `X-Forwarded-For` upstream first.

## FAQ

<details>
<summary>How is this different from the Log Analyzer tool?</summary>

Log Analyzer summarizes general log health: severity counts, top errors, time span, and volume. Weblog Attack Analyzer is security-focused: it looks specifically at access-log request targets, status codes, user agents, and source IP behaviour to flag attack attempts and scanning.

</details>

<details>
<summary>Does it upload my logs?</summary>

No. The standalone page runs the WebAssembly analyzer in your browser. Chat and CLI runs are local to the gizza runtime as well; there is no registry lookup, enrichment service, or remote scoring API.

</details>

<details>
<summary>Will this catch every attack?</summary>

No. It uses deterministic signatures and simple per-IP thresholds. It catches common probes and noisy scans well, but a targeted attacker can evade signatures or blend into normal volume. Treat the output as a prioritized review queue, then confirm with application logs, WAF events, and server context.

</details>

<details>
<summary>Why are percent-decoded matches important?</summary>

Attack payloads in URLs are often encoded, sometimes twice. For example `%3Cscript%3E` is `<script>` and `%252e%252e%252f` becomes `../` after two decode passes. The tool checks raw, once-decoded, and twice-decoded targets by default so those probes are not missed.

</details>

## Related tools

- [Strip accents and transliterate text to plain ASCII](https://gizza.ai/tools/accent-stripper/): Paste text and strip accents to plain ASCII. Transliterate non-Latin scripts, preserve chosen characters, lowercase, and audit unmapped output.
- [Brotli Decompress](https://gizza.ai/tools/brotli-decompress/): Paste a Brotli (.br) payload as Base64 or hex and read what's inside. Output as text, hex, or Base64, with size and ratio stats. Free, private, no sign-up.
- [Child Growth Percentile Calculator](https://gizza.ai/tools/child-growth-percentile/): Compute CDC child growth-chart percentiles and z-scores from age, sex, height, weight and head circumference. Supports metric or US units.
- [Dependency Risk Auditor](https://gizza.ai/tools/dependency-risk-auditor/): Audit a package.json, package-lock.json, yarn.lock or pnpm-lock.yaml for wildcard versions, git/URL deps, install scripts and missing integrity hashes.
- [DNA / RNA Reverse Complement](https://gizza.ai/tools/dna-reverse-complement/): Reverse-complement DNA or RNA in your browser — full IUPAC ambiguity codes, FASTA records, preserved case, complement-only and reverse-only modes. No upload.