The logs of a server are showing a great number of 404 responses in a short time. Apparently somebody used a tool/script to look for known vulnerabilities by combining the server and part of the path with elements like /login or /admin.php.

Is there a way to identify the script that was used without getting and analyzing various hacking/pentest tools?

  • 2
    This is an extremely simple script, which every skilled programmer could write in under a minute. Therefore it is not possible to detect the tool/script that was used. But you can use a search engine to determine the wordlist that has been used. – Martin Fürholz Jun 11 at 5:46
  • Agreed, probably the dictionary used can be identified. – Overmind Jun 11 at 5:50
  • A programmer would need a little more than a minute, and it would be interesting to know if the attacker was competent or just a "script kid." I'm no security expert, but knowing that it was a common kit/dictionary with the default settings would be reassuring; knowing that it was custom would be alarming. – o.m. Jun 11 at 6:27
  • If I should guess try searching for Dirbuster. That's a program some scriptkiddies are using. – CD Rohling Jun 11 at 17:53

Is there a way to identify the script that was used ...

Technically, the answer is "yes". You need to look for the specific signature of the methods used and look those up. There is not much more to say about that without any more details about the attack.

Unfortunately, the likelihood of identifying the type of attack from just your web server error logs is very, very low. There is likely not enough to build a signature from and you will not be able to distinguish a custom script from well-known tools at default settings.

Years ago, I did a forensic analysis on a massive dump of packet captures and was able to determine, from the network packet details, the exact tools used, even down to the version ranges they were likely to be. While fascinating and a cool rabbit hole to fall down, the exercise was ultimately not a good use of my time.

... knowing that it was a common kit/dictionary with the default settings would be reassuring; knowing that it was custom would be alarming.

I hear this a lot from people, and while wanting to quantify your threats is often a good thing, there is not a lot of value in this particular threat analysis.

If someone is holding a gun to your head, does it matter if the attacker made the gun or bought it off the shelf? Are you aware that even the most elite hackers will use off-the-shelf tools at default settings because there is often no need to "get clever" because the basic tools work, especially at the initial stages of an attack?

How would your response be any different as a web admin if the attack came from a default kit or from a targetted attacker? You are being targetted by both types of attackers every second of every day, whether your logs show it or not. Your response to these threats is not to assume all attacks are elite hackers and then freak out, but rather to acknowledge that the Internet is an inherently hostile environment and to make sure you are running a tight ship and resilient processes, because any weakness will be discovered and exploited by someone, expert or noob.


Why dont use setup IPS/IDS, namely snort, in a container or docker to analysis packets. You can mirror any packets to snort or install host based snort on your client machine. You can find tons of rules are associated with treshold, content filter or IP assessment if it is not decoy scan.

  • Thanks for the proposal, but to make that happen I would have to recreate the attack which seems to be over for now. Doing that without access to the original kits seems a lot of work. – o.m. Jun 11 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.