java web攻击日志分析_多线程WEB安全日志分析脚本

#!/usr/bin/python

# -*- coding: utf-8 -*-

import os

import re

from multiprocessing.dummy import Pool as ThreadPool

import sys

import time

import pexpect

# 规则列表

rulelist = ['\.\./', 'select.+(from|limit)', '(?:(union(.*?)select))', 'having|rongjitest', 'sleep\((\s*)(\d*)(\s*)\)',

'benchmark\((.*)\,(.*)\)', 'base64_decode\(', '(?:from\W+information_schema\W)',

'(?:(?:current_)user|database|schema|connection_id)\s*\(', '(?:etc\/\W*passwd)',

'into(\s+)+(?:dump|out)file\s*', 'group\s+by.+\(', 'xwork.MethodAccessor',

'(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\(',