susam

Sinkholed

This story has been moved to my blog here: .

susam

Recon and Attack Vectors from My Logs

This document contains excerpts from my web server logs collected over a period of 7 years that shows various kinds of recon and attack vectors.

There were a total of 37.2 million lines of logs out of which 1.1 million unique HTTP requests (Method + URI) were found.

$ sed 's/^.* - - \[.*\] "\(.*\) HTTP\/.*" .*/\1/' access.log > requests.txt

susam

Logs for pika/pika#286

These logs demonstrate the issue reported in pika/pika#286.

recv.txt

DEBUG:pika.callback:Added: {'callback': <bound method BlockingConnection._on_connection_error of <pika.adapters.blocking_connection.BlockingConnection object at 0x00000000025F9E48>>, 'only': None, 'one_shot': False, 'arguments': None}
DEBUG:pika.callback:Added: {'callback': <bound method BlockingConnection._on_connection_start of <pika.adapters.blocking_connection.BlockingConnection object at 0x00000000025F9E48>>, 'only': None, 'one_shot': True, 'arguments': None, 'calls': 1}
INFO:pika.adapters.base_connection:Connecting to 127.0.0.1:5672

DEBUG:pika.callback:Processing 0:Connection.Start

susam

Logs for pika/pika#410

These logs were generated by the scripts mentioned at pika/pika#410.

sendlog.txt

DEBUG:pika.callback:Added: {'callback': <bound method BlockingConnection._on_connection_error of <pika.adapters.blocking_connection.BlockingConnection object at 0x00000000026A6DD8>>, 'only': None, 'one_shot': False, 'arguments': None}

DEBUG:pika.callback:Added: {'callback': >, 'only': None, 'one_shot': True, 'arguments': None, 'calls': 1}