#!/bin/bash

patterns=(
/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/
/HNAP1/
/prov/aastra.cfg
/f4bb336d/
/module/action/param1/\${@die\(md5\(HelloThinkPHP\)\)}
/App/\?content=die\(md5\(HelloThinkPHP\)\)
/editBlackAndWhiteList
/0015650000000.cfg
)
# you should fill that array with real patterns

somemagicnumber=3
# how many tests before you action
#TODO weight patterns score using associative array

GetIPs () {
sort -u < <(grep -Eo "[0-9]{1,3}(\.[0-9]{1,3}){3}" server.log ) 
}

CheckPatterns () {
IP=$1
matchcount=0
while read LOG
do
  for P in "${Patterns[@]}"
  do
    [[ $LOG =~ $P ]] && ((matchcount++))
  done
done < <(grep "$IP" server.log )

[[ $matchcount -gt $somemagicnumber ]] \
  || return 0 \
  && Action $IP

return $?
}

Action () {
IP=$1
echo do something based on $IP
return $?
}

while read IP
do
  CheckPatterns $IP \
    || echo some error \
    && echo do something based on $IP
done < <( GetIPs )

#!/bin/bash
selip (){
for i in $(seq "$cntip")
do
rdip=$(sed -n ${i}p < iplist)
echo "$i - $rdip"
done
echo ""
echo "Choose an IP to check or write (exit) to quit "
echo -n "Choose from 1 to $cntip : "
read -r ip
if [[ "$ip" == "exit" ]]
then
exit 0
fi
if [[ -z "$ip" ]]
then
echo "Empty value detected"
sleep 3
clear
selip
fi
ckip=$(sed -n ${ip}p iplist)
gtdata=$(grep "$ckip" serverlog.tmp | awk '{print$7}' > tmpfile)
echo "Looking for a match in definitions"
rdln=$(wc -l tmpfile | awk '{print$1}')
if [[ "$rdln" -le "1" ]]
then
readata=$(sed -n 1p tmpfile)

match=$(grep "$readata" definition.conf | awk '{print$1}')
if [[ -z "$match" ]]
then
echo "No results were found"
exit 0
else
echo "Intrusion detected from $ckip was : $match"
exit 0
fi
fi
for i in $(seq "$rdln")
do
readata=$(sed -n ${i}p tmpfile)
match=$(grep "$readata" definition.conf | awk '{print$1}')
if [[ ! -z "$match" ]]
then
echo "Intrusion detected from $ckip was : $match"
exit 0
fi
done
echo "No results were found"
exit 0

}

rm iplist >/dev/null 2>&1
rm tmpfile >/dev/null 2>&1
echo "Checking ips in Log"
echo ""
var1=$(awk '{print$1}' serverlog.tmp | uniq > iplist)
cntip=$(wc -l iplist | awk '{print$1}')
selip

#!/bin/bash
GetIPs () {
    sort -u < <(grep -Eo "[0-9]{1,3}(\.[0-9]{1,3}){3}" serverlog.tmp )
}

CheckPatterns () {
IP=$1
while read LOG
do
    for P in "${Patterns[@]}"
    do  
        [[ ${LOG} =~ ${P#* } ]] && echo ${P% *} matches ${IP}
    done
done < <(grep "$IP" serverlog.tmp )

return $?
}

Patterns=()
while read foo
do
    Patterns+=("${foo}")
done < definition.conf
while read IP
do
    CheckPatterns $IP
done < <( GetIPs )

#!/bin/bash


CheckPatterns () {
IP=$1
while read LOG
do
        for P in "${Patterns[@]}"
        do
                [[ ${LOG} =~ ${P#* } ]] && echo ${P% *} matches ${IP}
        done
done < <(grep "$IP" serverlog.tmp )

return $?
}
echo -n "Write IP : "
read -r ipd

Patterns=()
while read foo
do
        Patterns+=("${foo}")
done < definition.conf

while read IP
do
        CheckPatterns $IP 
done < <( echo "$ipd" )

#!/bin/bash
CheckPatterns () {
IP=$1
while read LOG
do
        for P in "${Patterns[@]}"
        do
                [[ ${LOG} =~ ${P#* } ]] && echo ${P% *} matches ${IP}
        done
done < <(grep "$IP" serverlog.tmp )

return $?
}
Patterns=()
while read foo
do
        Patterns+=("${foo}")
done < definition.conf

echo -n "Write IP : "
read -r ipd
# TODO check to see if $ipd looks like a valid ip address

CheckPatterns $ipd

#!/bin/bash

IPs=$(cut -d" " -f1 server.log | sort -u)

PS3="Your choice (or Ctrl-C to quit): "
select myIP in $IPs; do
  awk -f server.awk -v IP=$myIP server.conf server.log
done

GetIPs(){
sort -u < <(grep -Eo "[0-9]{1,3}(\.[0-9]{1,3}){3}" server.log
}

IPs=($(GetIPs))

PS3="Your choice (or Ctrl-C to quit): "
select myIP in "${IPs[@]}"; do
  awk -f server.awk -v IP=$myIP server.conf server.log
done

#!/bin/bash
serverlog=serverlog.tmp.txt
definition=definition.conf.txt
GetSuspect () {
    for P in "${Patterns[@]}"
    do  
        grep "${P#* }" "${serverlog}"
    done
}
Patterns=()
while read foo
do
    Patterns+=("${foo}")
done < ${definition}

time ( GetSuspect | grep -Eo "[0-9]{1,3}(\.[0-9]{1,3}){3}" )
time ( GetSuspect )