{
  "slug": "weblog-attack-analyzer",
  "name": "gizza-ai/weblog-attack-analyzer",
  "version": "0.1.0",
  "title": "Weblog Attack Analyzer — Access Log SQLi, XSS & Scanner Triage — gizza.ai",
  "description": "Paste Apache, Nginx, or IIS access logs and flag SQLi, XSS, traversal, scanner user agents, sensitive probes, and high-volume offending IPs.",
  "tags": [
    "weblog attack analyzer",
    "access log security",
    "apache log analyzer",
    "nginx log analyzer",
    "iis log analyzer",
    "sqli log scan",
    "xss log scan",
    "scanner detection",
    "web security logs",
    "blocklist generator"
  ],
  "category": "utilities",
  "urls": {
    "page": "https://gizza.ai/tools/weblog-attack-analyzer/",
    "markdown": "https://gizza.ai/tools/weblog-attack-analyzer/index.md",
    "descriptor": "https://gizza.ai/tools/weblog-attack-analyzer/tool.json",
    "deep_link_example": "https://gizza.ai/tools/weblog-attack-analyzer/?logs=203.0.113.5%20-%20-%20%5B11%2FMar%2F2024%3A09%3A14%3A02%20%2B0000%5D%20%22GET%20%2Fproducts.php%3Fid%3D1%2527%2BUNION%2BSELECT%2Bnull%2Cversion%28%29--%2B-%20HTTP%2F1.1%22%20200%20512%20%22-%22%20%22sqlmap%2F1.7%22&category=all&min_severity=all&output=report&offender_threshold=20&error_threshold=5&decode=true&limit=500"
  },
  "cli": "gizza tool weblog-attack-analyzer '203.0.113.5 - - [11/Mar/2024:09:14:02 +0000] \"GET /products.php?id=1%27+UNION+SELECT+null,version()--+- HTTP/1.1\" 200 512 \"-\" \"sqlmap/1.7\"'",
  "tool": {
    "description": "Analyze pasted Apache/Nginx or IIS access logs for common web-attack traffic. Flags SQL injection, XSS, path traversal, file inclusion, RCE payloads, scanner user agents (sqlmap, nikto, nuclei, etc.), sensitive-path probes (.env, .git, wp-login, phpMyAdmin), and high-volume / enumeration / brute-force source IPs. Percent-decodes request targets by default to catch encoded payloads. Outputs a report, table, JSON, CSV, or an IP blocklist. Runs locally on pasted log text; it is a heuristic triage aid, not a WAF or IDS replacement.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "category": {
          "default": "all",
          "description": "Attack category filter: all (default), SQL injection, XSS, path traversal, remote code execution, file inclusion, scanner user agents, or sensitive-path probes.",
          "enum": [
            "all",
            "sqli",
            "xss",
            "traversal",
            "rce",
            "file-include",
            "scanner",
            "probe"
          ],
          "type": "string"
        },
        "decode": {
          "default": true,
          "description": "Also scan once- and twice-percent-decoded request targets so encoded payloads are caught. Default true.",
          "type": "boolean"
        },
        "error_threshold": {
          "default": 5,
          "description": "404s or 401/403s from one source IP needed to label enumeration or brute-force behaviour (1-100000). Default 5; pass 0 to use the default.",
          "maximum": 100000,
          "minimum": 1,
          "type": "integer"
        },
        "limit": {
          "default": 500,
          "description": "Maximum flagged requests to render in report/table/json/csv outputs (1-5000). Default 500; counts always cover the whole log.",
          "maximum": 5000,
          "minimum": 1,
          "type": "integer"
        },
        "logs": {
          "description": "Apache/Nginx common or combined access-log lines, or IIS W3C extended logs with a #Fields header. Paste one request per line.",
          "type": "string"
        },
        "min_severity": {
          "default": "all",
          "description": "Minimum severity to report. all (default) includes low through critical; high hides low/medium probes; critical shows only critical SQLi/RCE-style findings.",
          "enum": [
            "all",
            "low",
            "medium",
            "high",
            "critical"
          ],
          "type": "string"
        },
        "offender_threshold": {
          "default": 20,
          "description": "Requests from one source IP needed to label it high-volume (1-100000). Default 20; pass 0 in CLI/chat to use the default.",
          "maximum": 100000,
          "minimum": 1,
          "type": "integer"
        },
        "output": {
          "default": "report",
          "description": "Output format: report (default Markdown-style summary), table, json, csv, or blocklist (one offending IP per line).",
          "enum": [
            "report",
            "table",
            "json",
            "csv",
            "blocklist"
          ],
          "type": "string"
        }
      },
      "required": [
        "logs"
      ],
      "type": "object"
    }
  }
}