What are the common features to identify Brute-Force attack from Apache log file?

Question

There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular expression. I would love to know the different regular expressions available for detecting brute-force attacks from Apache log file.

Answer 1

You can use this oneliner:

awk '/login.php/ {print $1}' access_log | sort | uniq -c | sort -gr | head -10

What each part of the pipeline does:

awk '/login.php/ {print $1}' access_log: reads access.log, searches for every line containing login.php and prints the first word (the IP address)

sort will, well, sort.

uniq -c counts the amount of entries for every string

sort -gr will sort in reverse, by numeric value

head -10 returns the top 10 entries.

You can change the head -10 to the amount of IPs you want in the result.

Answer 2

High volume of traffic:

^(\S+) .+ .+ \[.*\] "(POST|GET) .+ HTTP/\d\.\d" 401 \d+ "-" ".+"$

This regular expression matches any HTTP POST or GET request that returns a 401 error and is made from the same IP address, indicating a potential brute-force attack.

Unusual user agents:

^.*"(POST|GET).*HTTP.*" 401 .*"(python|curl|wget|libwww-perl|python-requests|httrack|HTTPie)"\s*$

This regular expression matches any HTTP POST or GET request that returns a 401 error and is made by a user agent associated with automated tools like Python, curl, wget, etc.

Failed login attempts:

^.*"(POST|GET).*HTTP.*" 401 .*"[^"]*"\s*$

Multiple login attempts:

^.*"(POST|GET).*HTTP.*" 40[13] .*"[^"]*"\s*$

Answer 3

You can run grep against Apache access log searching for your login page, use awk to carve out the source IP address then use wc to count how many times a source IP hit your login page.

That would be a simple way to check for brute-force login attacks from a single source.