Share 
## https://sploitus.com/exploit?id=1B9405E9-91A8-542F-A7A9-F3CDEAF2DD03
# Log threat detector
A lightweight Python security tool that parses web server logs to detect SQL Injection, XSS, Directory Traversal, and Brute-Force attacks in real-time, exporting structured JSON threat reports.

# Web Server Log Parser & Threat Detector

A lightweight, high-performance Python security tool designed to parse web server access logs, detect malicious web attack vectors in real-time, and export structured security threat reports for auditing.

![Python Version](https://img.shields.io/badge/python-3.8%2B-blue.svg)
![Security Focus](https://img.shields.io/badge/focus-Log%20Analysis%20%26%20SIEM-red.svg)

---

## Key Features

* **Multi-Vector Attack Detection**: Identifies common web application attack patterns:
  * **SQL Injection (SQLi)**: Detects query manipulation, keyword injection (`UNION`, `SELECT`), and authentication bypass attempts.
  * **Cross-Site Scripting (XSS)**: Flags inline script tags, URI JavaScript injection, and event handler payloads.
  * **Directory Traversal**: Detects path manipulation patterns (`../` / `..\`) targeting restricted system files (e.g., `/etc/passwd`).
  * **Brute-Force Login Attacks**: Tracks HTTP `401 Unauthorized` responses per IP address against configurable threshold limits.
* **Precision Regex Engine**: Fine-tuned signature matching to eliminate false positives between overlapping attack signatures (e.g., string quotes inside XSS vs. SQLi).
* **Flexible Ingestion**: Seamlessly ingests live `access.log` files with an automatic fallback to built-in sample logs for rapid testing.
* **Structured JSON Reporting**: Automatically exports identified threats to `threat_report.json` for easy integration with SIEMs or security dashboard workflows.

---

## Project Structure

```text
โ”œโ”€โ”€ log_threat_detector.py   # Core detection script
โ”œโ”€โ”€ access.log               # (Optional) Live web server access log
โ””โ”€โ”€ threat_report.json       # Exported security findings