## https://sploitus.com/exploit?id=D12E0EED-D3A3-57D5-B95C-580B76956789
# nginx_log_analyzer
Nginx Access Log Security Analysis Tool — detects common attacks and generates security reports in multiple formats (Bash + Go versions). Conducts offline security checks on Web server access logs: SQL injection, XSS, path traversal, command injection, brute force attacks, crawling, CC attacks, sensitive path detection, etc. Generates high-risk IP alerts based on a weighted threat scoring system and produces reports in Markdown, HTML (dark theme), and TXT formats, along with firewalld blocking recommendation scripts.
## Features
- **12 types of detection rules**: SQL injection, command injection, XSS, path traversal, sensitive file detection, tool scanning identification, brute force attacks, high-frequency requests, CC attacks, abnormal status codes, suspicious Referer, time distribution
- **Weighted threat scoring system**: Scores for individual IPs (severe ≥30, high-risk ≥15, medium-risk ≥5, low-risk ≥1); supports false positives via whitelist filtering
- **Multiple report formats**: Markdown, HTML (dark theme), TXT – easily exportable; includes firewalld blocking recommendation scripts
- **Single traversal statistics engine**: Completes all statistics in one pass, performs well with large logs (Go version)
- **Format adaptability**: Extracts IPs, status codes, URIs, UA, and time from any nginx log_format
- **CC sliding window detection**: Alerts when a single IP’s request count exceeds a threshold every minute
- **Configuration flexibility**: Adjust whitelists and thresholds via config files, environment variables, or command-line parameters
- **Exit code semantics**: `0` for no threat, `1` for low risk, `2` for medium risk, `3` for high risk; can integrate with cron/CI alarms
## Quick Start
### Go Version (Recommended, High Performance)
```bash
# Build (Linux)
go build -o nginx_log_analyzer . # Run
./nginx_log_analyzer -f /usr/local/nginx/logs/access.log -m all -n 10000 -o all
```
### Bash Version (Zero Dependency, Easy Debugging)
```bash
chmod +x nginx_log_analyzer.sh
./nginx_log_analyzer.sh /usr/local/nginx/logs/access.log all 10000 all
```
## Usage
### Go Version Parameters
```
nginx_log_analyzer [flags]
```
| Flag | Default | Description |
| --- | --- | --- |
| `-f` | `/usr/local/nginx/logs/access.log` | Log file path, `-` indicates stdin |
| `-m` | `all` | Analysis mode (see table below) |
| `-n` | `10000` | Number of recent rows to analyze |
| `-o` | `all` | Report format: md, html, txt, all |
| `-c` | Automatic configuration search | Configuration file path |
| `-w` | Built-in default | Whitelist IP/CIDR, separated by commas |
| `-d` | Current directory | Report output directory |
| `-h` | - | Help |
| `-v` | - | Version |
### Analysis Modes
| Mode | Detection Items |
| --- | --- |
| `all` | All detections (default) |
| `inject` | Injection-based attacks (SQLi, XSS, traversal, command injection, sensitive paths, UA scanning) |
| `bruteforce` | Brute force attacks, background frequent attempts, 401-403 status codes |
| `crawler` | Frequent requests, crawling UA identification, CC attacks |
| `traffic` | Status code distribution, request methods, 4xx/5xx errors |
| `path` | Sensitive path detection, POST targets |
| `referer` | Suspicious Referer, hotlinking |
| `threat` | Threat scoring overview, high-risk IP alerts |
| `time` | Requests per hour, attack distribution |
| `cc` | CC attack sliding window detection |
### Example
```bash
# Full analysis of the last 5,000 lines, generating all reports
./nginx_log_analyzer -f /usr/local/nginx/logs/access.log -m all -n 10000 -o all
```
./nginx_log_analyzer -f access.log -m all -n 50000 -o all
# Only for injection attacks, generate a MD report
./nginx_log_analyzer -f access.log -m inject -o md
# Custom report directory and whitelist
./nginx_log_analyzer -f access.log -d /opt/reports -w "127.0.0.1,10.0.0.0/8"
# Read logs from the pipe
tail -n 50000 access.log | ./nginx_log_analyzer -f - -o md
## Output Products
The report will be generated in the specified directory after execution:
| File | Format | Purpose |
| --- | --- | --- |
| `nginx_report_.md` | MD | Markdown security report |
| `nginx_report_.html` | HTML | Visual security report (dark theme) |
| `nginx_report_.txt` | TXT | Plaintext security report |
| `nginx_ban_.sh` | SH | Script for blocking high-risk IPs (**Must be confirmed manually**)
## Threat Scoring System
| Attack Type | Score | Severity | Score Range | Action Suggestions |
| --- | --- | --- | --- | --- |
| SQL Injection / Command Injection | +3 | Severe | ≥ 30 | Immediate ban + notification to operations team |
| XSS / Path Traversal / Sensitive Paths | +2 | High Risk | ≥ 15 | Ban + manual analysis |
| Scanning Tool UA | +1 | Medium Risk | ≥ 5 | Record alert + monitoring |
| Abnormal Status Codes (4xx/5xx > 20 times) | +5 | Low Risk | ≥ 1 | Observe |
| CC Attack hits (> 60 times/minute) | +10 | - | - | -
## Configuration
Supports configuration files (in the same directory as the program or `/etc/nginx_log_analyzer.conf`) and environment variables:
```bash
# Example: CC threshold and whitelist
CC_THRESHOLD=60
WHITELIST="127.0.0.1 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
```
For the Bash version, use the `NGX Ana_` prefix for environment variables, such as `NGXAna_WHITELIST`, `NGXAna_CC_THRESHOLD`. For detailed configuration, see [docs/nginx_log_analyzer_deployment.doc](docs/nginx_log_analyzer_deployment.doc). ## Building and Cross-compiling
The Go version is implemented using pure standard libraries (Go 1.21+), with no third-party dependencies:
```bash
# Linux amd64
GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o nginx_log_analyzer_linux_amd64 . # Linux arm64 (Kirin V10 aarch64, etc.)
GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -o nginx_log_analyzer_linux_arm64 . # Windows (PowerShell)
$env:GOOS="windows"; $env:GOARCH="amd64"; go build -o nginx_log_analyzer.exe .
```
## Documentation
- [Security requirements document (detection rules / scoring system / handling procedures)](docs/nginx_log_analyzer_securityRequirements.doc)
- [Deployment documentation (environment requirements / deployment steps / usage instructions / FAQ)](docs/nginx_log_analyzer_deployment.doc)
## Notes
- This tool is **auxiliary detection**; it cannot replace WAF/IDS/IPS. The detection results must be manually reviewed before any actions are taken.
- The ban script **must include manual verification of the IP list** before execution.
- Only URLs and headers are analyzed; attacks in the POST body may be missed.
- Attackers can bypass feature matching through encoding obfuscation. It is recommended to continuously update detection rules.
## License
[MIT](LICENSE)
[source-iocs-preserved const=NGX_ANA_CC_THRESHOLD,NGX_ANA_WHITELIST]