dlightdaily.com

IT | Internet | Electronics

Menu
  • Home
  • FAN Nagios
  • About Us
  • Contact
  • Write For US
Menu

Offline Squid Proxy log analysis

Posted on August 12, 2018August 12, 2018 by VD

Squid Access Log analysis with simple python command

What is SquidMagic Master?

squidmagic is a tool which is designed to analyze a web-based network traffic to detect central command and control (C&C) servers and Malicious site, using Squid proxy server and Spamhaus.

 

Who is  Spamhaus?

The Spamhaus Project is an international nonprofit organization that tracks spam and related cyber threats such as phishing, malware and botnets, provides realtime actionable and highly accurate threat intelligence to the Internet’s major networks, corporations and security vendors, and works with law enforcement agencies to identify and pursue spam and malware sources worldwid

 

 

 

You Could get many post regarding squid log analyse in a sort way which are not in depth, However, while you are doing in practice scenario, i’m sure you would get many error to run a tool.

Requirement:

Linux Machine (I’m Using Ubuntu 16.04)
Squidmagic Master tool
 
Dependent packages:
Python3

 

sh, termcolor, configparser, pyzmq.

So here is the step by step configuration.

Install Python 3.6 from PPA

You can also install Python 3.6 from J Fernyhough’s Personal Package Archive
Install the following requirements.
apt-get install software-properties-common python-software-properties
Run the Following command to add the ubuntu repository.
sudo add-apt-repository ppa:jonathonf/python-3.6
Update the repository
sudo apt-get update
Install Python version 3.6 on Ubuntu 16.04
and finally install Python version 3.6
sudo apt-get install python3.6
However, it can shows you the older python version which is 3.5
# python3 -V 
Python 3.5.2
On my Ubuntu machine, there are two versions of python available, python3.5 as default python version and python3.6. In this step, we will change the default python version to python 3.6
sudo update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.5 1
 
sudo update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.6 2
sudo update-alternatives --config python3
 
 
 
Selection    Path                Priority   Status
————————————————————
* 0            /usr/bin/python3.6   2         auto mode
  1            /usr/bin/python3.5   1         manual mode
  2            /usr/bin/python3.6   2         manual mode
 
After the installation of python and selected a best version, we need to install python module so here is the following command to get install.
 
Python Packages name : python-zmq
sudo apt-get install python-zmq
Install Python Packages: sh
 
sh is a full-fledged subprocess replacement for Python 2.6 – 3.6, PyPy and PyPy3 that allows you to call any program as if it were a function:
pip install sh
Install Python Package : python-pip
 
 
Pip is a package management system used to install and manage software packages written in Python which can be found in the Python Package Index (PyPI).
sudo apt-get install python-pip
install python package: termcolor
termcolor is Color formatting for output in terminal
pip install termcolor
Install python package: configparser
 
 

 

Note
The ConfigParser module has been renamed to configparser in Python 3. The 2to3 tool will automatically adapt imports when converting your sources to Python 3.
 
 
sudo pip install configparser
Go to your squidmagic dirctory which you had downloaded, if not you can download the tool https://github.com/ch3k1/squidmagic
 
Now we can run the script to following command.
python squidmagic.py /path of your access.log
                 _     _                       _      
                (_)   | |                     (_)     
 ___  __ _ _   _ _  __| |_ __ ___   __ _  __ _ _  ___ 
/ __|/ _` | | | | |/ _` | '_ ` _ \ / _` |/ _` | |/ __|
\__ \ (_| | |_| | | (_| | | | | | | (_| | (_| | | (__ 
|___/\__, |\__,_|_|\__,_|_| |_| |_|\__,_|\__, |_|\___|
        | |                               __/ |       
        |_|                              |___/        
     Analyzing...

Analyzing by SBL Advisory...
 Spam server detected, ip is 65.182.101.221
Analyzing by SBL_CSS Advisory...
 safe server detected, host or ip is 65.182.101.221
Analyzing by PBL Advisory...
 safe server detected, host or ip is 65.182.101.221
Share With Friends !
0
Bookmark and Share

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

CAPTCHA
Refresh

*

CommentLuv badgeShow more posts

Advertise

  • 104likes
  • 15comments
  • 31followers
  • 768followers

Recent Posts

  • Unable To Add SCHEDULED DOWN Time In (fan Nagios) Nagios.
  • HOW DO I FOUND MY WINDOWS PRODUCT KEY
  • NSClient++ Return Code Of 139 IS Out Of Bound…
  • How Do You Run A Script In Powershell?
  • What are the process state in Unix ?
  • Penetration Testing(Pen Test) The Ultimate Guide
  • WannaCRY Ransomware , How to keep your system safe
  • 20 Common Protocols and Their Well-Known Port Numbers
  • Powershell – How To – SID To User
  • windows script to check Server Uptime
  • Nagios Automation
  • Offline Squid Proxy log analysis
  • Clear DNS Cache – How to Guide
  • Honeywell Security – Pro-Watch Web Interface User Guide
  • How to install Active Directory Users and Computers for Windows 2008
©2019 dlightdaily.com | WordPress Theme by Superb Themes
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.OkPrivacy policy