mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
49 lines
1.4 KiB
Markdown
49 lines
1.4 KiB
Markdown
# API Reference: Web Server Log Intrusion Analysis
|
|
|
|
## Combined Log Format (Apache/Nginx)
|
|
```
|
|
<ip> <ident> <authuser> [<date>] "<method> <uri> <proto>" <status> <size> "<referer>" "<user-agent>"
|
|
```
|
|
|
|
## Python re Module - Log Parsing
|
|
```python
|
|
import re
|
|
pattern = re.compile(
|
|
r'(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] '
|
|
r'"(?P<method>\S+) (?P<uri>\S+) (?P<proto>[^"]*)" '
|
|
r'(?P<status>\d+) (?P<size>\S+) "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"'
|
|
)
|
|
match = pattern.match(line)
|
|
data = match.groupdict()
|
|
```
|
|
|
|
## GeoIP2 Python Library
|
|
```python
|
|
import geoip2.database
|
|
reader = geoip2.database.Reader("GeoLite2-City.mmdb")
|
|
response = reader.city("8.8.8.8")
|
|
response.country.name # "United States"
|
|
response.city.name # "Mountain View"
|
|
response.location.latitude # 37.386
|
|
response.location.longitude # -122.0838
|
|
reader.close()
|
|
```
|
|
|
|
## Attack Signature Categories
|
|
| Type | Example Pattern | Severity |
|
|
|------|----------------|----------|
|
|
| SQLi | `UNION SELECT`, `OR 1=1`, `SLEEP()` | Critical |
|
|
| LFI | `../../etc/passwd`, `php://filter` | High |
|
|
| XSS | `<script>`, `onerror=`, `javascript:` | High |
|
|
| Scanner | User-Agent: nikto, sqlmap, gobuster | Medium |
|
|
| Brute Force | >50 POST /login from same IP | High |
|
|
|
|
## Scanner User-Agent Signatures
|
|
| Tool | UA Pattern |
|
|
|------|-----------|
|
|
| Nikto | `Nikto/2.x` |
|
|
| sqlmap | `sqlmap/1.x` |
|
|
| DirBuster | `DirBuster-1.0` |
|
|
| Gobuster | `gobuster/3.x` |
|
|
| Wfuzz | `Wfuzz/3.x` |
|