Log files upload - find and remove active malicious code
To determine what happened in a hack, how, and when, the only thing that helps is taking a look at the web server log files. These are usually found in the /logs directory on the webspace or can be downloaded via the web hoster's control panel.
The so-called access logs record all HTTP requests. A distinction is made between GET and POST requests. In a hack, the latter are mainly relevant. In this case, data is passed to a script and thereby influences its further execution.
Analysis of POST requests
This tool generates an overview of the most frequent POST requests from the access logs, sorted by status code and front end/back end.
From this, used malicious files (backdoors, web shells) and spam scripts emerge, which are usually accessed via POST request.
Based on the content and modification time of these files, further occurrences can be searched for recursively, although in the rarest of cases there is only one pattern.
For further searching for malicious files, a comparison with a backup or the original archive (fresh Joomla/WordPress installation) is recommended, as described in the "Joomla hacked" or "WordPress hacked" article.
Requests to /administrator can be ignored if the backend is protected with a .htaccess password.
For security reasons, providing an email address is required, even if no manual review is desired.
Note: Only access.log files can be analyzed - no error.log files.
Rename the last (active) log file to *.log and select it together with older logs (usually *.gz) using multiple selection (Shift key from-to). It makes little sense to analyze logs from only 1-2 days. Ideally, the evaluation period should cover 4-6 weeks in order to gain as many insights as possible.
The automatic analysis is tailored to Joomla! and WordPress systems (but not limited to them) and is constantly being optimized.
It should by no means be assumed that all files containing malicious code can also be found in the logs - only those that were visibly accessed will appear here.
Changelog
28.03.2020: Admin actions by country are displayed.
11.09.2019: From now on, threatening GET requests in connection with WordPress hacks are also displayed.
Uploaded log files are stored on our server only temporarily for generating the report and are then deleted.
For data protection reasons, IP addresses, session IDs, etc. are not disclosed anywhere.
