Sunry hplc

hplc / record.sh

Created November 28, 2011 23:15

Record TCP port initialization connect and final connect events by iptables

	#!/bin/sh

	/sbin/iptables -A INPUT -p tcp --syn --dport 5118 -j LOG
	/sbin/iptables -A INPUT -p tcp --tcp-flags FIN FIN --dport 5118 -j LOG

hplc / check_post.sh

Created November 25, 2011 04:02

tcpdump Web POST content and parse the content

	#!/bin/sh
	# Check yesterday's post.pcap file and
	# report by Email if there's strange file post actions.
	# Put this script in cron to run everyday.

	pcapfile=`date -d"yesterday" +%m.%d`
	grep -a Dispo post.pcap-$pcapfile \| grep -aiE "php\|asp" > t

	if [ -s t ] ; then
	mail -s "Strange file post action found!" [email protected] < t