parameters: (self, data)
docstring: Detect possible Web Shell attacks.
          Use string comparison to scan GET request with the
          list of possible web shell payloads.
  
          Args:
              data (dict): Parsed log file data
  
          Raises:
              None
  
          Returns:
              None
docstring_summary: Detect possible Web Shell attacks.
          Use string comparison to scan GET request with the
          list of possible web shell payloads.
docstring_tokens: Detect possible Web Shell attacks . Use string comparison to scan GET request with the list of possible web shell payloads .
function: def detect_web_shell(self, data):
          """
          Detect possible Web Shell attacks.
          Use string comparison to scan GET request with the
          list of possible web shell payloads.
  
          Args:
              data (dict): Parsed log file data
  
          Raises:
              None
  
          Returns:
              None
          """
          for ip in data.keys():
              get_req = data[ip]["get"]
              if (self.payload_match(get_req)):
                  if ip not in self.logged_IP:  # if not logged earlier
                      self.logged_IP.append(ip)
                      last_time = data[ip]["ep_time"][0]
                      msg = "Possible web shell detected from: " + str(ip) + \
                            " on: " + str(utils.epoch_to_date(last_time))
                      self.logger.log(
                          msg,
                          logtype="warning"
                      )
                      utils.write_ip(str(ip))
                      # Generate CSV report using OSINT tools
                      self.osint_obj.perform_osint_scan(ip.strip(" "))
                      # Write malicious IP to file, to teach Firewall about the IP
                      write_mal_ip(ip.strip(" "))
function_tokens: def detect_web_shell ( self , data ) : for ip in data . keys ( ) : get_req = data [ ip ] [ "get" ] if ( self . payload_match ( get_req ) ) : if ip not in self . logged_IP : # if not logged earlier self . logged_IP . append ( ip ) last_time = data [ ip ] [ "ep_time" ] [ 0 ] msg = "Possible web shell detected from: " + str ( ip ) + " on: " + str ( utils . epoch_to_date ( last_time ) ) self . logger . log ( msg , logtype = "warning" ) utils . write_ip ( str ( ip ) ) # Generate CSV report using OSINT tools self . osint_obj . perform_osint_scan ( ip . strip ( " " ) ) # Write malicious IP to file, to teach Firewall about the IP write_mal_ip ( ip . strip ( " " ) )