EvergreenCartoons / SenselessViolence

CVE-2022-31814 Exploitation Toolkit.
4 stars 0 forks source link

Better log cleaning (surgical line removal) #4

Open EvergreenCartoons opened 2 years ago

EvergreenCartoons commented 2 years ago

After much searching, the following might be usable for surgical log editing:

printf '%s\n' 'g/python-requests/d' w q | ed -s /var/log/pfblockerng/dnsbl.log

We can do the same with nginx.log, etc.

We would need something to reliably match on, user-agent seems pretty reliable. Given these are firewalls, odds are they are at the very edge of the network anyway, so "blending in" with a user agent seems kind of pointless given we are zapping the logs. Also, TLS is in play.

Might consider it for the cleanup script...

I should look and see if this thing ships logs to somewhere. I bet the cheeky fucker does.