molu8bits / modsecurity-parser

modsecurity audit log analyser and parser
Apache License 2.0
76 stars 26 forks source link

Png Graph not show rule id #24

Closed matteocostantini closed 1 year ago

matteocostantini commented 1 year ago

image

khurshid-alam commented 1 year ago

Yes, same issue here. Using Python 3.8.10 on windows 11.

This is the part of modsec_audit.log file

--23480000-A--
[08/Apr/2023:00:00:45 +0530] 10520408740274907317 193.32.162.159 80 127.0.0.1 80
--23480000-B--
GET / HTTP/1.1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Accept-Encoding: gzip, deflate, gzip, deflate
Accept-Language: en US,en;q=0.9,sv;q=0.8
Host: 95.217.32.181
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46
X-Requested-With: XMLHttpRequest

--23480000-F--
HTTP/1.1 500 Internal Server Error

--23480000-H--
Message: Warning. Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "C:\/Program Files/ModSecurity IIS/owasp_crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "810"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "95.217.32.181"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
Apache-Handler: IIS
Stopwatch: 1680892245706662 0 (- - -)
Stopwatch2: 1680892245706662 0; combined=0, p1=0, p2=0, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
Producer: ModSecurity for IIS (STABLE)/2.9.3 (http://www.modsecurity.org/); OWASP_CRS/3.0.2.
Server: ModSecurity Standalone
Engine-Mode: "ENABLED"

--23480000-Z--

@molu8bits

molu8bits commented 1 year ago

Typo error in 618 line. Should start with: f'{i} --> {j} hits' instead of current: 'f{i} --> {j} hits'

I am going to fix it soon.

molu8bits commented 1 year ago

@khurshid-alam @matteocostantini Fixed with latest 0.5.0 version

khurshid-alam commented 1 year ago

Thanka. It is working now.