(self, data)
Detect possible Web Shell attacks.
        Use string comparison to scan GET request with the
        list of possible web shell payloads.

        Args:
            data (dict): Parsed log file data

        Raises:
            None

        Returns:
            None
Detect possible Web Shell attacks.
        Use string comparison to scan GET request with the
        list of possible web shell payloads.
Detect possible Web Shell attacks . Use string comparison to scan GET request with the list of possible web shell payloads .
def detect_web_shell(self, data):
        """
        Detect possible Web Shell attacks.
        Use string comparison to scan GET request with the
        list of possible web shell payloads.

        Args:
            data (dict): Parsed log file data

        Raises:
            None

        Returns:
            None
        """
        for ip in data.keys():
            get_req = data[ip]["get"]
            if (self.payload_match(get_req)):
                if ip not in self.logged_IP:  # if not logged earlier
                    self.logged_IP.append(ip)
                    last_time = data[ip]["ep_time"][0]
                    msg = "Possible web shell detected from: " + str(ip) + \
                          " on: " + str(utils.epoch_to_date(last_time))
                    self.logger.log(
                        msg,
                        logtype="warning"
                    )
                    utils.write_ip(str(ip))
                    # Generate CSV report using OSINT tools
                    self.osint_obj.perform_osint_scan(ip.strip(" "))
                    # Write malicious IP to file, to teach Firewall about the IP
                    write_mal_ip(ip.strip(" "))
def detect_web_shell ( self , data ) : for ip in data . keys ( ) : get_req = data [ ip ] [ "get" ] if ( self . payload_match ( get_req ) ) : if ip not in self . logged_IP : # if not logged earlier self . logged_IP . append ( ip ) last_time = data [ ip ] [ "ep_time" ] [ 0 ] msg = "Possible web shell detected from: " + str ( ip ) + " on: " + str ( utils . epoch_to_date ( last_time ) ) self . logger . log ( msg , logtype = "warning" ) utils . write_ip ( str ( ip ) ) # Generate CSV report using OSINT tools self . osint_obj . perform_osint_scan ( ip . strip ( " " ) ) # Write malicious IP to file, to teach Firewall about the IP write_mal_ip ( ip . strip ( " " ) )