0
votes
1answer
133 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
-6
votes
1answer
179 views

Suspicious random IPs requesting image from my server - botnet? [closed]

I've been getting a steady stream of requests for the same logo file from random IP addresses, many of which indicate they're mobile when I look them up. I'm at a loss to explain this. Anyone seen ...
5
votes
2answers
184 views

What are the parameters to be logged in a web application?

I am working on developing a secure authentication system with SSO. Until now I have been using the logging framework to generate logs that help in debugging the application. I wonder if there is a ...
0
votes
2answers
400 views

Monitoring access logs of Web application [closed]

Is there any open source framework or libraries which can provide security monitoring capabilities for Web application by analyzing Web application access logs. Basically i need to monitor and analyze ...
3
votes
5answers
1k views

Is it wrong to collect and store IP addresses?

I am developing a PHP analytics program. I am using IP addresses to get its corresponding country. I was wondering if its OK to store both the IP address and Country or if its better if I just store ...
6
votes
2answers
2k views

Google Analytics on a secured site

Just read this article on Google Analytics and the risk of forged certificates, where it said: Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
1
vote
1answer
496 views

Wireshark log analyzing

I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
16
votes
2answers
2k views

Which HTTP status codes are interesting from a security point of view?

I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out? For example, 200 hits can be considered to be 'regular behavior' whereas ...
4
votes
2answers
160 views

What is the benefit of combining different web log files with different formats?

What is the benefit of combining different web log files with different formats in terms of web application security? In other words, how does combining iis log file with apache log file help in ...