Add centralized IP reputation tracking system
Created a comprehensive IP reputation system that tracks IPs across all toolkit scripts with tags/attack types, scores, and detailed analytics. NEW FILES: - lib/ip-reputation.sh: Core reputation library with optimized database * Fast lookup using pipe-delimited file format * Attack type tagging system (bitmask: SQL, XSS, RCE, Bot, Scanner, etc.) * Reputation scoring (0-100) based on hits and attack severity * GeoIP country lookup integration * Automatic cleanup of old entries * Thread-safe with file locking - modules/security/ip-reputation-manager.sh: Interactive management tool * Query individual IPs with full details * View top malicious/active IPs * Database statistics and analytics * Manual IP flagging/whitelisting * Import IPs from logs * Export to readable reports * Live monitoring mode INTEGRATION: All security and analysis scripts now use the centralized reputation system: - modules/website/500-error-tracker.sh: * Tracks IPs generating 500 errors * Tags bots/scanners with BOT/SCANNER flags * Background processing for performance - modules/security/live-attack-monitor.sh: * Maps attack types to reputation flags * Tracks SSH bruteforce, SQL injection, XSS, DDoS, etc. * Real-time reputation updates - modules/website/website-error-analyzer.sh: * Tags filtered bots in error analysis * Builds IP reputation from website errors - launcher.sh: * Added IP Reputation Manager to Bot & Traffic Analysis menu * Menu option 4 in Security > Analysis > Bot & Traffic Analysis KEY FEATURES: ✓ Centralized IP tracking across ALL scripts ✓ Multi-tag system (IP can have multiple attack types) ✓ Reputation scores increase with more tags/attacks ✓ Country tracking via GeoIP ✓ Optimized for high-volume traffic (attacks with 1000s of IPs) ✓ Fast lookups even during DDoS ✓ Background processing doesn't slow down analysis ✓ Database cleanup/maintenance tools ✓ Export for reports and sharing BENEFITS: - Single source of truth for IP reputation - Scripts share intelligence (bot detected in one script = flagged for all) - Track IPs across time and multiple attack vectors - Identify repeat offenders with multiple attack types - Make blocking decisions based on comprehensive data - Performance optimized with file locking and background updates
This commit is contained in:
cschantz
+10
-8
@@ -222,10 +222,11 @@ show_bot_analysis_menu() {
|
|||||||
echo -e " ${CYAN}1)${NC} Full Bot Analysis - Complete scan (all logs)"
|
echo -e " ${CYAN}1)${NC} Full Bot Analysis - Complete scan (all logs)"
|
||||||
echo -e " ${CYAN}2)${NC} Quick Scan (1 hour) - Recent activity only"
|
echo -e " ${CYAN}2)${NC} Quick Scan (1 hour) - Recent activity only"
|
||||||
echo -e " ${CYAN}3)${NC} Live Monitor - Real-time threat tracking"
|
echo -e " ${CYAN}3)${NC} Live Monitor - Real-time threat tracking"
|
||||||
echo -e " ${CYAN}4)${NC} IP Lookup & Investigation - Deep-dive on specific IP"
|
echo -e " ${CYAN}4)${NC} IP Reputation Manager - Query/manage IP database (NEW!)"
|
||||||
echo -e " ${CYAN}5)${NC} DDoS Pattern Detector - Identify DDoS attacks"
|
echo -e " ${CYAN}5)${NC} IP Lookup & Investigation - Deep-dive on specific IP"
|
||||||
echo -e " ${CYAN}6)${NC} Traffic Pattern Analysis - Bandwidth & connection patterns"
|
echo -e " ${CYAN}6)${NC} DDoS Pattern Detector - Identify DDoS attacks"
|
||||||
echo -e " ${CYAN}7)${NC} User-Agent Analysis - Bot fingerprinting"
|
echo -e " ${CYAN}7)${NC} Traffic Pattern Analysis - Bandwidth & connection patterns"
|
||||||
|
echo -e " ${CYAN}8)${NC} User-Agent Analysis - Bot fingerprinting"
|
||||||
echo ""
|
echo ""
|
||||||
echo -e " ${RED}0)${NC} Back to Analysis Menu"
|
echo -e " ${RED}0)${NC} Back to Analysis Menu"
|
||||||
echo ""
|
echo ""
|
||||||
@@ -983,15 +984,16 @@ handle_bot_analysis_menu() {
|
|||||||
1) run_module "security" "bot-analyzer.sh" ;;
|
1) run_module "security" "bot-analyzer.sh" ;;
|
||||||
2) run_module "security" "bot-analyzer.sh" -H "${QUICK_SCAN_HOURS:-1}" ;;
|
2) run_module "security" "bot-analyzer.sh" -H "${QUICK_SCAN_HOURS:-1}" ;;
|
||||||
3) run_module "security" "live-monitor.sh" ;;
|
3) run_module "security" "live-monitor.sh" ;;
|
||||||
4)
|
4) run_module "security" "ip-reputation-manager.sh" ;;
|
||||||
|
5)
|
||||||
show_banner
|
show_banner
|
||||||
echo -e "${BOLD}IP Lookup & Investigation${NC}"
|
echo -e "${BOLD}IP Lookup & Investigation${NC}"
|
||||||
read -p "Enter IP address: " ip
|
read -p "Enter IP address: " ip
|
||||||
[ -n "$ip" ] && run_module "security" "ip-lookup.sh" "$ip"
|
[ -n "$ip" ] && run_module "security" "ip-lookup.sh" "$ip"
|
||||||
;;
|
;;
|
||||||
5) run_module "security" "ddos-detector.sh" ;;
|
6) run_module "security" "ddos-detector.sh" ;;
|
||||||
6) run_module "security" "traffic-pattern-analysis.sh" ;;
|
7) run_module "security" "traffic-pattern-analysis.sh" ;;
|
||||||
7) run_module "security" "user-agent-analysis.sh" ;;
|
8) run_module "security" "user-agent-analysis.sh" ;;
|
||||||
0) return ;;
|
0) return ;;
|
||||||
*) echo -e "${RED}Invalid option${NC}"; sleep 1 ;;
|
*) echo -e "${RED}Invalid option${NC}"; sleep 1 ;;
|
||||||
esac
|
esac
|
||||||
|
|||||||
@@ -0,0 +1,459 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
################################################################################
|
||||||
|
# IP Reputation Management Library
|
||||||
|
################################################################################
|
||||||
|
# Purpose: Centralized IP reputation tracking across all toolkit scripts
|
||||||
|
# Features:
|
||||||
|
# - Fast lookups using indexed file structure
|
||||||
|
# - Tracks: hits, country, last seen, reputation score, attack types
|
||||||
|
# - Optimized for high-volume traffic (attacks with thousands of IPs)
|
||||||
|
# - Automatic cleanup of old entries
|
||||||
|
# - GeoIP integration
|
||||||
|
# - Shared across all monitoring/analysis scripts
|
||||||
|
################################################################################
|
||||||
|
|
||||||
|
# Database location
|
||||||
|
IP_REP_DB_DIR="${IP_REP_DB_DIR:-/var/lib/server-toolkit/ip-reputation}"
|
||||||
|
IP_REP_DB="$IP_REP_DB_DIR/ip_database.db"
|
||||||
|
IP_REP_INDEX="$IP_REP_DB_DIR/ip_index.idx"
|
||||||
|
IP_REP_LOCK="$IP_REP_DB_DIR/.db.lock"
|
||||||
|
|
||||||
|
# Reputation score thresholds
|
||||||
|
REP_SCORE_CRITICAL=80 # Definitely malicious
|
||||||
|
REP_SCORE_HIGH=60 # Likely malicious
|
||||||
|
REP_SCORE_MEDIUM=40 # Suspicious
|
||||||
|
REP_SCORE_LOW=20 # Borderline
|
||||||
|
REP_SCORE_SAFE=0 # Safe/legitimate
|
||||||
|
|
||||||
|
# Attack type flags (bitmask for efficient storage)
|
||||||
|
ATTACK_FLAG_SQL_INJECTION=1
|
||||||
|
ATTACK_FLAG_XSS=2
|
||||||
|
ATTACK_FLAG_PATH_TRAVERSAL=4
|
||||||
|
ATTACK_FLAG_RCE=8
|
||||||
|
ATTACK_FLAG_BRUTEFORCE=16
|
||||||
|
ATTACK_FLAG_DDOS=32
|
||||||
|
ATTACK_FLAG_BOT=64
|
||||||
|
ATTACK_FLAG_SCANNER=128
|
||||||
|
ATTACK_FLAG_EXPLOIT=256
|
||||||
|
|
||||||
|
# Initialize the IP reputation database
|
||||||
|
init_ip_reputation_db() {
|
||||||
|
mkdir -p "$IP_REP_DB_DIR" 2>/dev/null
|
||||||
|
|
||||||
|
# Create empty database if it doesn't exist
|
||||||
|
if [ ! -f "$IP_REP_DB" ]; then
|
||||||
|
touch "$IP_REP_DB"
|
||||||
|
chmod 600 "$IP_REP_DB"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -f "$IP_REP_INDEX" ]; then
|
||||||
|
touch "$IP_REP_INDEX"
|
||||||
|
chmod 600 "$IP_REP_INDEX"
|
||||||
|
fi
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
# Database format (pipe-delimited for fast parsing):
|
||||||
|
# IP|HIT_COUNT|REPUTATION_SCORE|COUNTRY|ATTACK_FLAGS|FIRST_SEEN|LAST_SEEN|LAST_ACTIVITY|NOTES
|
||||||
|
# Example:
|
||||||
|
# 192.168.1.100|523|75|US|193|1730000000|1730800000|SQL injection on /admin|Auto-flagged
|
||||||
|
|
||||||
|
# Lock management for concurrent access
|
||||||
|
acquire_lock() {
|
||||||
|
local timeout=10
|
||||||
|
local elapsed=0
|
||||||
|
|
||||||
|
while [ -f "$IP_REP_LOCK" ] && [ $elapsed -lt $timeout ]; do
|
||||||
|
sleep 0.1
|
||||||
|
elapsed=$((elapsed + 1))
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ $elapsed -ge $timeout ]; then
|
||||||
|
# Stale lock, remove it
|
||||||
|
rm -f "$IP_REP_LOCK" 2>/dev/null
|
||||||
|
fi
|
||||||
|
|
||||||
|
touch "$IP_REP_LOCK"
|
||||||
|
}
|
||||||
|
|
||||||
|
release_lock() {
|
||||||
|
rm -f "$IP_REP_LOCK" 2>/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
# Fast IP lookup using grep with optimizations
|
||||||
|
# Returns: IP data if found, empty if not found
|
||||||
|
lookup_ip() {
|
||||||
|
local ip="$1"
|
||||||
|
|
||||||
|
[ -z "$ip" ] && return 1
|
||||||
|
[ ! -f "$IP_REP_DB" ] && return 1
|
||||||
|
|
||||||
|
# Use grep with fixed string for speed
|
||||||
|
grep -m 1 "^${ip}|" "$IP_REP_DB" 2>/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
# Add or update IP in database
|
||||||
|
# Usage: update_ip_reputation IP [HIT_INCREMENT] [SCORE_DELTA] [ATTACK_FLAGS] [ACTIVITY_NOTE]
|
||||||
|
update_ip_reputation() {
|
||||||
|
local ip="$1"
|
||||||
|
local hit_increment="${2:-1}"
|
||||||
|
local score_delta="${3:-0}"
|
||||||
|
local new_attack_flags="${4:-0}"
|
||||||
|
local activity_note="${5:-}"
|
||||||
|
|
||||||
|
[ -z "$ip" ] && return 1
|
||||||
|
|
||||||
|
init_ip_reputation_db
|
||||||
|
acquire_lock
|
||||||
|
|
||||||
|
local existing
|
||||||
|
existing=$(lookup_ip "$ip")
|
||||||
|
|
||||||
|
local current_time=$(date +%s)
|
||||||
|
|
||||||
|
if [ -n "$existing" ]; then
|
||||||
|
# Parse existing entry
|
||||||
|
IFS='|' read -r old_ip hit_count rep_score country attack_flags first_seen last_seen last_activity notes <<< "$existing"
|
||||||
|
|
||||||
|
# Update values
|
||||||
|
hit_count=$((hit_count + hit_increment))
|
||||||
|
rep_score=$((rep_score + score_delta))
|
||||||
|
|
||||||
|
# Cap reputation score at 0-100
|
||||||
|
[ $rep_score -lt 0 ] && rep_score=0
|
||||||
|
[ $rep_score -gt 100 ] && rep_score=100
|
||||||
|
|
||||||
|
# Merge attack flags (bitwise OR)
|
||||||
|
attack_flags=$((attack_flags | new_attack_flags))
|
||||||
|
|
||||||
|
last_seen="$current_time"
|
||||||
|
|
||||||
|
# Update activity note if provided
|
||||||
|
if [ -n "$activity_note" ]; then
|
||||||
|
last_activity="$activity_note"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Remove old entry and add updated one
|
||||||
|
sed -i "/^${ip}|/d" "$IP_REP_DB"
|
||||||
|
echo "$ip|$hit_count|$rep_score|$country|$attack_flags|$first_seen|$last_seen|$last_activity|$notes" >> "$IP_REP_DB"
|
||||||
|
else
|
||||||
|
# New entry
|
||||||
|
local country=$(get_ip_country "$ip")
|
||||||
|
echo "$ip|$hit_increment|$score_delta|$country|$new_attack_flags|$current_time|$current_time|$activity_note|" >> "$IP_REP_DB"
|
||||||
|
fi
|
||||||
|
|
||||||
|
release_lock
|
||||||
|
|
||||||
|
# Rebuild index if database is getting large
|
||||||
|
local db_size=$(wc -l < "$IP_REP_DB" 2>/dev/null || echo "0")
|
||||||
|
if [ $db_size -gt 10000 ] && [ $((RANDOM % 100)) -eq 0 ]; then
|
||||||
|
rebuild_index & # Background process
|
||||||
|
fi
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get IP country using multiple methods
|
||||||
|
get_ip_country() {
|
||||||
|
local ip="$1"
|
||||||
|
local country="??"
|
||||||
|
|
||||||
|
# Method 1: Check if geoiplookup is available
|
||||||
|
if command -v geoiplookup >/dev/null 2>&1; then
|
||||||
|
country=$(geoiplookup "$ip" 2>/dev/null | grep -oP 'Country Edition: \K[A-Z]{2}' | head -1)
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Method 2: Check if geoiplookup6 for IPv6
|
||||||
|
if [ -z "$country" ] || [ "$country" = "??" ]; then
|
||||||
|
if command -v geoiplookup6 >/dev/null 2>&1 && [[ "$ip" =~ : ]]; then
|
||||||
|
country=$(geoiplookup6 "$ip" 2>/dev/null | grep -oP 'Country Edition: \K[A-Z]{2}' | head -1)
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Method 3: Check /usr/share/GeoIP databases directly
|
||||||
|
if [ -z "$country" ] || [ "$country" = "??" ]; then
|
||||||
|
if [ -f "/usr/share/GeoIP/GeoIP.dat" ] && command -v geoiplookup >/dev/null 2>&1; then
|
||||||
|
country=$(geoiplookup "$ip" 2>/dev/null | awk -F': ' '{print $2}' | cut -d',' -f1 | head -1)
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Method 4: Fallback - use whois (slower, only if critically needed)
|
||||||
|
# Disabled by default for performance
|
||||||
|
# if [ -z "$country" ] || [ "$country" = "??" ]; then
|
||||||
|
# country=$(whois "$ip" 2>/dev/null | grep -iE "^country:" | head -1 | awk '{print $2}')
|
||||||
|
# fi
|
||||||
|
|
||||||
|
# Default if all methods fail
|
||||||
|
[ -z "$country" ] && country="??"
|
||||||
|
|
||||||
|
echo "$country"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Increment IP hit count (fast path for common case)
|
||||||
|
increment_ip_hits() {
|
||||||
|
local ip="$1"
|
||||||
|
local increment="${2:-1}"
|
||||||
|
|
||||||
|
update_ip_reputation "$ip" "$increment" 0 0 ""
|
||||||
|
}
|
||||||
|
|
||||||
|
# Flag IP for specific attack type
|
||||||
|
flag_ip_attack() {
|
||||||
|
local ip="$1"
|
||||||
|
local attack_type="$2"
|
||||||
|
local score_increase="${3:-5}"
|
||||||
|
local note="${4:-$attack_type}"
|
||||||
|
|
||||||
|
local attack_flag=0
|
||||||
|
|
||||||
|
case "$attack_type" in
|
||||||
|
SQL_INJECTION|sql) attack_flag=$ATTACK_FLAG_SQL_INJECTION; score_increase=15 ;;
|
||||||
|
XSS|xss) attack_flag=$ATTACK_FLAG_XSS; score_increase=10 ;;
|
||||||
|
PATH_TRAVERSAL|path) attack_flag=$ATTACK_FLAG_PATH_TRAVERSAL; score_increase=12 ;;
|
||||||
|
RCE|rce|shell) attack_flag=$ATTACK_FLAG_RCE; score_increase=20 ;;
|
||||||
|
BRUTEFORCE|brute) attack_flag=$ATTACK_FLAG_BRUTEFORCE; score_increase=8 ;;
|
||||||
|
DDOS|ddos) attack_flag=$ATTACK_FLAG_DDOS; score_increase=10 ;;
|
||||||
|
BOT|bot) attack_flag=$ATTACK_FLAG_BOT; score_increase=3 ;;
|
||||||
|
SCANNER|scan) attack_flag=$ATTACK_FLAG_SCANNER; score_increase=5 ;;
|
||||||
|
EXPLOIT|exploit) attack_flag=$ATTACK_FLAG_EXPLOIT; score_increase=15 ;;
|
||||||
|
*) attack_flag=0; score_increase=5 ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
update_ip_reputation "$ip" 1 "$score_increase" "$attack_flag" "$note"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Mark IP as legitimate (reduces reputation score)
|
||||||
|
mark_ip_legitimate() {
|
||||||
|
local ip="$1"
|
||||||
|
local note="${2:-Marked as legitimate}"
|
||||||
|
|
||||||
|
update_ip_reputation "$ip" 0 -20 0 "$note"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get IP reputation category
|
||||||
|
get_ip_reputation_category() {
|
||||||
|
local score="$1"
|
||||||
|
|
||||||
|
if [ $score -ge $REP_SCORE_CRITICAL ]; then
|
||||||
|
echo "CRITICAL"
|
||||||
|
elif [ $score -ge $REP_SCORE_HIGH ]; then
|
||||||
|
echo "HIGH"
|
||||||
|
elif [ $score -ge $REP_SCORE_MEDIUM ]; then
|
||||||
|
echo "MEDIUM"
|
||||||
|
elif [ $score -ge $REP_SCORE_LOW ]; then
|
||||||
|
echo "LOW"
|
||||||
|
else
|
||||||
|
echo "SAFE"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get attack types from flags
|
||||||
|
decode_attack_flags() {
|
||||||
|
local flags="$1"
|
||||||
|
local attacks=""
|
||||||
|
|
||||||
|
[ $((flags & ATTACK_FLAG_SQL_INJECTION)) -ne 0 ] && attacks="${attacks}SQL,"
|
||||||
|
[ $((flags & ATTACK_FLAG_XSS)) -ne 0 ] && attacks="${attacks}XSS,"
|
||||||
|
[ $((flags & ATTACK_FLAG_PATH_TRAVERSAL)) -ne 0 ] && attacks="${attacks}PATH,"
|
||||||
|
[ $((flags & ATTACK_FLAG_RCE)) -ne 0 ] && attacks="${attacks}RCE,"
|
||||||
|
[ $((flags & ATTACK_FLAG_BRUTEFORCE)) -ne 0 ] && attacks="${attacks}BRUTE,"
|
||||||
|
[ $((flags & ATTACK_FLAG_DDOS)) -ne 0 ] && attacks="${attacks}DDOS,"
|
||||||
|
[ $((flags & ATTACK_FLAG_BOT)) -ne 0 ] && attacks="${attacks}BOT,"
|
||||||
|
[ $((flags & ATTACK_FLAG_SCANNER)) -ne 0 ] && attacks="${attacks}SCAN,"
|
||||||
|
[ $((flags & ATTACK_FLAG_EXPLOIT)) -ne 0 ] && attacks="${attacks}EXPLOIT,"
|
||||||
|
|
||||||
|
# Remove trailing comma
|
||||||
|
attacks="${attacks%,}"
|
||||||
|
|
||||||
|
[ -z "$attacks" ] && attacks="NONE"
|
||||||
|
|
||||||
|
echo "$attacks"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Query and display IP information
|
||||||
|
query_ip_reputation() {
|
||||||
|
local ip="$1"
|
||||||
|
|
||||||
|
init_ip_reputation_db
|
||||||
|
|
||||||
|
local data
|
||||||
|
data=$(lookup_ip "$ip")
|
||||||
|
|
||||||
|
if [ -z "$data" ]; then
|
||||||
|
echo "IP $ip not found in reputation database"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
IFS='|' read -r ip hit_count rep_score country attack_flags first_seen last_seen last_activity notes <<< "$data"
|
||||||
|
|
||||||
|
local category=$(get_ip_reputation_category "$rep_score")
|
||||||
|
local attacks=$(decode_attack_flags "$attack_flags")
|
||||||
|
local first_seen_date=$(date -d "@$first_seen" '+%Y-%m-%d %H:%M:%S' 2>/dev/null || echo "$first_seen")
|
||||||
|
local last_seen_date=$(date -d "@$last_seen" '+%Y-%m-%d %H:%M:%S' 2>/dev/null || echo "$last_seen")
|
||||||
|
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
echo "IP Address: $ip"
|
||||||
|
echo "Country: $country"
|
||||||
|
echo "Reputation: $rep_score/100 [$category]"
|
||||||
|
echo "Total Hits: $hit_count"
|
||||||
|
echo "Attack Types: $attacks"
|
||||||
|
echo "First Seen: $first_seen_date"
|
||||||
|
echo "Last Seen: $last_seen_date"
|
||||||
|
echo "Last Activity: ${last_activity:-None recorded}"
|
||||||
|
echo "Notes: ${notes:-None}"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get top IPs by reputation score
|
||||||
|
get_top_malicious_ips() {
|
||||||
|
local limit="${1:-20}"
|
||||||
|
|
||||||
|
init_ip_reputation_db
|
||||||
|
|
||||||
|
[ ! -f "$IP_REP_DB" ] && return 1
|
||||||
|
|
||||||
|
# Sort by reputation score (field 3), descending
|
||||||
|
sort -t'|' -k3 -rn "$IP_REP_DB" | head -n "$limit"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get top IPs by hit count
|
||||||
|
get_top_active_ips() {
|
||||||
|
local limit="${1:-20}"
|
||||||
|
|
||||||
|
init_ip_reputation_db
|
||||||
|
|
||||||
|
[ ! -f "$IP_REP_DB" ] && return 1
|
||||||
|
|
||||||
|
# Sort by hit count (field 2), descending
|
||||||
|
sort -t'|' -k2 -rn "$IP_REP_DB" | head -n "$limit"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Clean up old entries (not seen in X days)
|
||||||
|
cleanup_old_ips() {
|
||||||
|
local days_old="${1:-90}"
|
||||||
|
|
||||||
|
init_ip_reputation_db
|
||||||
|
acquire_lock
|
||||||
|
|
||||||
|
local cutoff_time=$(($(date +%s) - (days_old * 86400)))
|
||||||
|
local temp_file="${IP_REP_DB}.tmp"
|
||||||
|
|
||||||
|
# Keep only IPs seen within the cutoff time
|
||||||
|
awk -F'|' -v cutoff="$cutoff_time" '$7 >= cutoff' "$IP_REP_DB" > "$temp_file"
|
||||||
|
|
||||||
|
mv "$temp_file" "$IP_REP_DB"
|
||||||
|
|
||||||
|
release_lock
|
||||||
|
|
||||||
|
echo "Cleaned up IPs not seen in $days_old days"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Rebuild index for faster lookups (for very large databases)
|
||||||
|
rebuild_index() {
|
||||||
|
init_ip_reputation_db
|
||||||
|
acquire_lock
|
||||||
|
|
||||||
|
# Create sorted index by IP for binary search (future optimization)
|
||||||
|
sort -t'|' -k1 "$IP_REP_DB" > "$IP_REP_INDEX"
|
||||||
|
|
||||||
|
release_lock
|
||||||
|
}
|
||||||
|
|
||||||
|
# Export reputation database to readable format
|
||||||
|
export_ip_reputation() {
|
||||||
|
local output_file="${1:-/tmp/ip_reputation_export_$(date +%Y%m%d_%H%M%S).txt}"
|
||||||
|
|
||||||
|
init_ip_reputation_db
|
||||||
|
|
||||||
|
{
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
echo "SERVER TOOLKIT - IP REPUTATION DATABASE EXPORT"
|
||||||
|
echo "Generated: $(date '+%Y-%m-%d %H:%M:%S')"
|
||||||
|
echo "Total IPs: $(wc -l < "$IP_REP_DB" 2>/dev/null || echo 0)"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
printf "%-15s | %-7s | %-4s | %-8s | %-6s | %-30s | %-19s\n" \
|
||||||
|
"IP ADDRESS" "HITS" "CTRY" "REP" "LEVEL" "ATTACKS" "LAST SEEN"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
|
||||||
|
# Sort by reputation score, descending
|
||||||
|
sort -t'|' -k3 -rn "$IP_REP_DB" | while IFS='|' read -r ip hit_count rep_score country attack_flags first_seen last_seen last_activity notes; do
|
||||||
|
local category=$(get_ip_reputation_category "$rep_score")
|
||||||
|
local attacks=$(decode_attack_flags "$attack_flags")
|
||||||
|
local last_seen_date=$(date -d "@$last_seen" '+%Y-%m-%d %H:%M' 2>/dev/null || echo "$last_seen")
|
||||||
|
|
||||||
|
printf "%-15s | %-7s | %-4s | %-3s/100 | %-8s | %-30s | %-19s\n" \
|
||||||
|
"$ip" "$hit_count" "$country" "$rep_score" "$category" "${attacks:0:30}" "$last_seen_date"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
} > "$output_file"
|
||||||
|
|
||||||
|
echo "IP reputation database exported to: $output_file"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Check if IP should be blocked (based on reputation)
|
||||||
|
should_block_ip() {
|
||||||
|
local ip="$1"
|
||||||
|
local threshold="${2:-$REP_SCORE_HIGH}" # Default: block if reputation >= 60
|
||||||
|
|
||||||
|
local data
|
||||||
|
data=$(lookup_ip "$ip")
|
||||||
|
|
||||||
|
[ -z "$data" ] && return 1 # Unknown IP, don't block
|
||||||
|
|
||||||
|
IFS='|' read -r _ _ rep_score _ _ _ _ _ _ <<< "$data"
|
||||||
|
|
||||||
|
[ $rep_score -ge $threshold ] && return 0 # Should block
|
||||||
|
return 1 # Should not block
|
||||||
|
}
|
||||||
|
|
||||||
|
# Batch import IPs from various sources
|
||||||
|
import_ips_from_log() {
|
||||||
|
local log_file="$1"
|
||||||
|
local attack_type="${2:-SUSPICIOUS}"
|
||||||
|
local score_per_hit="${3:-5}"
|
||||||
|
|
||||||
|
[ ! -f "$log_file" ] && return 1
|
||||||
|
|
||||||
|
# Extract IPs and count occurrences
|
||||||
|
grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' "$log_file" | \
|
||||||
|
sort | uniq -c | while read count ip; do
|
||||||
|
update_ip_reputation "$ip" "$count" "$score_per_hit" 0 "Imported from $log_file"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "Imported IPs from $log_file"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Statistics summary
|
||||||
|
show_ip_statistics() {
|
||||||
|
init_ip_reputation_db
|
||||||
|
|
||||||
|
local total_ips=$(wc -l < "$IP_REP_DB" 2>/dev/null || echo 0)
|
||||||
|
local critical=$(awk -F'|' -v thresh=$REP_SCORE_CRITICAL '$3 >= thresh' "$IP_REP_DB" 2>/dev/null | wc -l)
|
||||||
|
local high=$(awk -F'|' -v low=$REP_SCORE_HIGH -v hi=$REP_SCORE_CRITICAL '$3 >= low && $3 < hi' "$IP_REP_DB" 2>/dev/null | wc -l)
|
||||||
|
local medium=$(awk -F'|' -v low=$REP_SCORE_MEDIUM -v hi=$REP_SCORE_HIGH '$3 >= low && $3 < hi' "$IP_REP_DB" 2>/dev/null | wc -l)
|
||||||
|
local low=$(awk -F'|' -v low=$REP_SCORE_LOW -v hi=$REP_SCORE_MEDIUM '$3 >= low && $3 < hi' "$IP_REP_DB" 2>/dev/null | wc -l)
|
||||||
|
local safe=$(awk -F'|' -v thresh=$REP_SCORE_LOW '$3 < thresh' "$IP_REP_DB" 2>/dev/null | wc -l)
|
||||||
|
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
echo "IP REPUTATION DATABASE STATISTICS"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
echo "Total Tracked IPs: $total_ips"
|
||||||
|
echo ""
|
||||||
|
echo "By Reputation Level:"
|
||||||
|
echo " CRITICAL (≥80): $critical"
|
||||||
|
echo " HIGH (60-79): $high"
|
||||||
|
echo " MEDIUM (40-59): $medium"
|
||||||
|
echo " LOW (20-39): $low"
|
||||||
|
echo " SAFE (<20): $safe"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Initialize on library load
|
||||||
|
init_ip_reputation_db
|
||||||
Executable
+464
@@ -0,0 +1,464 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
################################################################################
|
||||||
|
# IP Reputation Manager
|
||||||
|
################################################################################
|
||||||
|
# Purpose: View, query, and manage the centralized IP reputation database
|
||||||
|
# Features:
|
||||||
|
# - Query individual IPs
|
||||||
|
# - View top malicious IPs
|
||||||
|
# - View top active IPs
|
||||||
|
# - Export database
|
||||||
|
# - Database statistics
|
||||||
|
# - Cleanup old entries
|
||||||
|
# - Manual IP flagging/whitelisting
|
||||||
|
################################################################################
|
||||||
|
|
||||||
|
# Get script directory
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||||
|
source "$SCRIPT_DIR/lib/common-functions.sh"
|
||||||
|
source "$SCRIPT_DIR/lib/system-detect.sh"
|
||||||
|
source "$SCRIPT_DIR/lib/ip-reputation.sh"
|
||||||
|
|
||||||
|
# Require root
|
||||||
|
if [ "$EUID" -ne 0 ]; then
|
||||||
|
print_error "This script must be run as root"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Menu display
|
||||||
|
show_menu() {
|
||||||
|
clear
|
||||||
|
print_banner "IP Reputation Manager"
|
||||||
|
|
||||||
|
# Show quick stats
|
||||||
|
local total_ips=$(wc -l < "$IP_REP_DB" 2>/dev/null || echo 0)
|
||||||
|
local db_size=$(du -h "$IP_REP_DB" 2>/dev/null | awk '{print $1}' || echo "0B")
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${BLUE}${BOLD}Database Status:${NC} $total_ips IPs tracked | Size: $db_size"
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}Query & View:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${GREEN}1)${NC} Query IP Reputation - Look up specific IP"
|
||||||
|
echo -e " ${GREEN}2)${NC} Top Malicious IPs - Highest reputation scores"
|
||||||
|
echo -e " ${GREEN}3)${NC} Top Active IPs - Most hits/requests"
|
||||||
|
echo -e " ${GREEN}4)${NC} Database Statistics - Overview of tracked IPs"
|
||||||
|
echo -e " ${GREEN}5)${NC} Live Monitoring - Real-time reputation updates"
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}Database Management:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${BLUE}6)${NC} Export Database - Export to readable text file"
|
||||||
|
echo -e " ${BLUE}7)${NC} Cleanup Old Entries - Remove IPs not seen in X days"
|
||||||
|
echo -e " ${BLUE}8)${NC} Rebuild Index - Optimize database for speed"
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}Manual Actions:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${YELLOW}9)${NC} Flag IP as Malicious - Manually mark IP as threat"
|
||||||
|
echo -e " ${YELLOW}10)${NC} Mark IP as Legitimate - Whitelist/reduce score"
|
||||||
|
echo -e " ${YELLOW}11)${NC} Import IPs from Log - Batch import from file"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${RED}0)${NC} Exit"
|
||||||
|
echo ""
|
||||||
|
echo -e "${CYAN}──────────────────────────────────────────────────────────────${NC}"
|
||||||
|
echo -n "Select option: "
|
||||||
|
}
|
||||||
|
|
||||||
|
# Query individual IP
|
||||||
|
query_ip_interactive() {
|
||||||
|
clear
|
||||||
|
print_banner "Query IP Reputation"
|
||||||
|
echo ""
|
||||||
|
echo -n "Enter IP address to query: "
|
||||||
|
read -r ip_address
|
||||||
|
|
||||||
|
if [ -z "$ip_address" ]; then
|
||||||
|
print_error "No IP address provided"
|
||||||
|
press_enter
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Validate IP format (basic check)
|
||||||
|
if ! [[ "$ip_address" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
||||||
|
print_error "Invalid IP address format"
|
||||||
|
press_enter
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
query_ip_reputation "$ip_address"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# View top malicious IPs
|
||||||
|
view_top_malicious() {
|
||||||
|
clear
|
||||||
|
print_banner "Top Malicious IPs"
|
||||||
|
echo ""
|
||||||
|
echo -n "How many top IPs to show? [20]: "
|
||||||
|
read -r limit
|
||||||
|
limit="${limit:-20}"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${RED}${BOLD}Top $limit Most Malicious IPs (by Reputation Score)${NC}"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
printf "%-15s | %-7s | %-4s | %-8s | %-8s | %-30s\n" \
|
||||||
|
"IP ADDRESS" "HITS" "CTRY" "REP" "LEVEL" "ATTACK TYPES"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
|
||||||
|
get_top_malicious_ips "$limit" | while IFS='|' read -r ip hit_count rep_score country attack_flags first_seen last_seen last_activity notes; do
|
||||||
|
local category=$(get_ip_reputation_category "$rep_score")
|
||||||
|
local attacks=$(decode_attack_flags "$attack_flags")
|
||||||
|
|
||||||
|
# Color code by reputation
|
||||||
|
local color="$NC"
|
||||||
|
case "$category" in
|
||||||
|
CRITICAL) color="$RED$BOLD" ;;
|
||||||
|
HIGH) color="$RED" ;;
|
||||||
|
MEDIUM) color="$YELLOW" ;;
|
||||||
|
LOW) color="$CYAN" ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
printf "${color}%-15s | %-7s | %-4s | %-3s/100 | %-8s | %-30s${NC}\n" \
|
||||||
|
"$ip" "$hit_count" "$country" "$rep_score" "$category" "${attacks:0:30}"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
echo ""
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# View top active IPs
|
||||||
|
view_top_active() {
|
||||||
|
clear
|
||||||
|
print_banner "Top Active IPs"
|
||||||
|
echo ""
|
||||||
|
echo -n "How many top IPs to show? [20]: "
|
||||||
|
read -r limit
|
||||||
|
limit="${limit:-20}"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${YELLOW}${BOLD}Top $limit Most Active IPs (by Hit Count)${NC}"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
printf "%-15s | %-7s | %-4s | %-8s | %-8s | %-30s\n" \
|
||||||
|
"IP ADDRESS" "HITS" "CTRY" "REP" "LEVEL" "ATTACK TYPES"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
|
||||||
|
get_top_active_ips "$limit" | while IFS='|' read -r ip hit_count rep_score country attack_flags first_seen last_seen last_activity notes; do
|
||||||
|
local category=$(get_ip_reputation_category "$rep_score")
|
||||||
|
local attacks=$(decode_attack_flags "$attack_flags")
|
||||||
|
|
||||||
|
# Color code by hit count
|
||||||
|
local color="$NC"
|
||||||
|
if [ $hit_count -gt 10000 ]; then
|
||||||
|
color="$RED$BOLD"
|
||||||
|
elif [ $hit_count -gt 1000 ]; then
|
||||||
|
color="$YELLOW"
|
||||||
|
fi
|
||||||
|
|
||||||
|
printf "${color}%-15s | %-7s | %-4s | %-3s/100 | %-8s | %-30s${NC}\n" \
|
||||||
|
"$ip" "$hit_count" "$country" "$rep_score" "$category" "${attacks:0:30}"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
echo ""
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# Show statistics
|
||||||
|
view_statistics() {
|
||||||
|
clear
|
||||||
|
print_banner "Database Statistics"
|
||||||
|
echo ""
|
||||||
|
show_ip_statistics
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Additional stats
|
||||||
|
echo "Recent Activity (Last 24 hours):"
|
||||||
|
local cutoff=$(($(date +%s) - 86400))
|
||||||
|
local recent_count=$(awk -F'|' -v cut="$cutoff" '$7 >= cut' "$IP_REP_DB" 2>/dev/null | wc -l)
|
||||||
|
echo " Active IPs: $recent_count"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Top countries
|
||||||
|
echo "Top Countries by IP Count:"
|
||||||
|
awk -F'|' '{print $4}' "$IP_REP_DB" 2>/dev/null | grep -v '^$' | sort | uniq -c | sort -rn | head -5 | \
|
||||||
|
while read count country; do
|
||||||
|
printf " %-4s: %s IPs\n" "$country" "$count"
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# Export database
|
||||||
|
export_database_interactive() {
|
||||||
|
clear
|
||||||
|
print_banner "Export IP Reputation Database"
|
||||||
|
echo ""
|
||||||
|
echo -n "Enter output file path [/tmp/ip_reputation_export.txt]: "
|
||||||
|
read -r output_path
|
||||||
|
output_path="${output_path:-/tmp/ip_reputation_export.txt}"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Exporting database to $output_path..."
|
||||||
|
export_ip_reputation "$output_path"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
print_success "Database exported successfully!"
|
||||||
|
echo ""
|
||||||
|
echo "View with: cat $output_path"
|
||||||
|
echo "Or: less $output_path"
|
||||||
|
echo ""
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# Cleanup old entries
|
||||||
|
cleanup_database_interactive() {
|
||||||
|
clear
|
||||||
|
print_banner "Cleanup Old Entries"
|
||||||
|
echo ""
|
||||||
|
echo "Remove IPs that haven't been seen in how many days?"
|
||||||
|
echo ""
|
||||||
|
echo -n "Days [90]: "
|
||||||
|
read -r days
|
||||||
|
days="${days:-90}"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "This will remove IPs not seen in the last $days days."
|
||||||
|
echo -n "Continue? (yes/no): "
|
||||||
|
read -r confirm
|
||||||
|
|
||||||
|
if [ "$confirm" != "yes" ]; then
|
||||||
|
echo "Cancelled"
|
||||||
|
press_enter
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
cleanup_old_ips "$days"
|
||||||
|
echo ""
|
||||||
|
print_success "Cleanup complete!"
|
||||||
|
echo ""
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# Rebuild index
|
||||||
|
rebuild_index_interactive() {
|
||||||
|
clear
|
||||||
|
print_banner "Rebuild Database Index"
|
||||||
|
echo ""
|
||||||
|
echo "Rebuilding index for optimized lookups..."
|
||||||
|
rebuild_index
|
||||||
|
echo ""
|
||||||
|
print_success "Index rebuilt successfully!"
|
||||||
|
echo ""
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# Flag IP as malicious
|
||||||
|
flag_ip_interactive() {
|
||||||
|
clear
|
||||||
|
print_banner "Flag IP as Malicious"
|
||||||
|
echo ""
|
||||||
|
echo -n "Enter IP address: "
|
||||||
|
read -r ip_address
|
||||||
|
|
||||||
|
if [ -z "$ip_address" ]; then
|
||||||
|
print_error "No IP address provided"
|
||||||
|
press_enter
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Attack Type:"
|
||||||
|
echo " 1) SQL Injection"
|
||||||
|
echo " 2) XSS"
|
||||||
|
echo " 3) Path Traversal"
|
||||||
|
echo " 4) RCE/Shell Upload"
|
||||||
|
echo " 5) Brute Force"
|
||||||
|
echo " 6) DDoS"
|
||||||
|
echo " 7) Bot/Scanner"
|
||||||
|
echo " 8) Exploit"
|
||||||
|
echo ""
|
||||||
|
echo -n "Select [1]: "
|
||||||
|
read -r attack_choice
|
||||||
|
attack_choice="${attack_choice:-1}"
|
||||||
|
|
||||||
|
case "$attack_choice" in
|
||||||
|
1) attack_type="SQL_INJECTION" ;;
|
||||||
|
2) attack_type="XSS" ;;
|
||||||
|
3) attack_type="PATH_TRAVERSAL" ;;
|
||||||
|
4) attack_type="RCE" ;;
|
||||||
|
5) attack_type="BRUTEFORCE" ;;
|
||||||
|
6) attack_type="DDOS" ;;
|
||||||
|
7) attack_type="SCANNER" ;;
|
||||||
|
8) attack_type="EXPLOIT" ;;
|
||||||
|
*) attack_type="SUSPICIOUS" ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -n "Notes/Description: "
|
||||||
|
read -r notes
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Flagging $ip_address for $attack_type..."
|
||||||
|
flag_ip_attack "$ip_address" "$attack_type" 0 "$notes"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
print_success "IP flagged successfully!"
|
||||||
|
echo ""
|
||||||
|
query_ip_reputation "$ip_address"
|
||||||
|
echo ""
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# Mark IP as legitimate
|
||||||
|
whitelist_ip_interactive() {
|
||||||
|
clear
|
||||||
|
print_banner "Mark IP as Legitimate"
|
||||||
|
echo ""
|
||||||
|
echo -n "Enter IP address: "
|
||||||
|
read -r ip_address
|
||||||
|
|
||||||
|
if [ -z "$ip_address" ]; then
|
||||||
|
print_error "No IP address provided"
|
||||||
|
press_enter
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -n "Reason/Notes: "
|
||||||
|
read -r notes
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Marking $ip_address as legitimate..."
|
||||||
|
mark_ip_legitimate "$ip_address" "$notes"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
print_success "IP marked as legitimate!"
|
||||||
|
echo ""
|
||||||
|
query_ip_reputation "$ip_address"
|
||||||
|
echo ""
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# Import from log file
|
||||||
|
import_log_interactive() {
|
||||||
|
clear
|
||||||
|
print_banner "Import IPs from Log File"
|
||||||
|
echo ""
|
||||||
|
echo -n "Enter log file path: "
|
||||||
|
read -r log_path
|
||||||
|
|
||||||
|
if [ ! -f "$log_path" ]; then
|
||||||
|
print_error "File not found: $log_path"
|
||||||
|
press_enter
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Attack Type (will be applied to all IPs):"
|
||||||
|
echo " 1) Suspicious (default)"
|
||||||
|
echo " 2) SQL Injection"
|
||||||
|
echo " 3) XSS"
|
||||||
|
echo " 4) Bot/Scanner"
|
||||||
|
echo " 5) DDoS"
|
||||||
|
echo ""
|
||||||
|
echo -n "Select [1]: "
|
||||||
|
read -r attack_choice
|
||||||
|
attack_choice="${attack_choice:-1}"
|
||||||
|
|
||||||
|
case "$attack_choice" in
|
||||||
|
2) attack_type="SQL_INJECTION" ;;
|
||||||
|
3) attack_type="XSS" ;;
|
||||||
|
4) attack_type="SCANNER" ;;
|
||||||
|
5) attack_type="DDOS" ;;
|
||||||
|
*) attack_type="SUSPICIOUS" ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Importing IPs from $log_path as $attack_type..."
|
||||||
|
import_ips_from_log "$log_path" "$attack_type" 5
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
print_success "Import complete!"
|
||||||
|
echo ""
|
||||||
|
press_enter
|
||||||
|
}
|
||||||
|
|
||||||
|
# Live monitoring (real-time updates)
|
||||||
|
live_monitoring() {
|
||||||
|
clear
|
||||||
|
print_banner "Live IP Reputation Monitoring"
|
||||||
|
echo ""
|
||||||
|
echo "Watching database for changes... (Press Ctrl+C to exit)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
local last_count=0
|
||||||
|
local last_update=0
|
||||||
|
|
||||||
|
while true; do
|
||||||
|
local current_count=$(wc -l < "$IP_REP_DB" 2>/dev/null || echo 0)
|
||||||
|
local current_time=$(stat -c %Y "$IP_REP_DB" 2>/dev/null || echo 0)
|
||||||
|
|
||||||
|
if [ $current_count -ne $last_count ] || [ $current_time -ne $last_update ]; then
|
||||||
|
clear
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
echo "LIVE IP REPUTATION MONITORING - $(date '+%H:%M:%S')"
|
||||||
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
|
echo ""
|
||||||
|
show_ip_statistics
|
||||||
|
echo ""
|
||||||
|
echo "Recent Top 10 Updates:"
|
||||||
|
get_top_malicious_ips 10 | head -10 | while IFS='|' read -r ip hit_count rep_score country attack_flags _ _ _ _; do
|
||||||
|
local category=$(get_ip_reputation_category "$rep_score")
|
||||||
|
local attacks=$(decode_attack_flags "$attack_flags")
|
||||||
|
printf "%-15s | %5s hits | %3s/100 | %-8s | %s\n" "$ip" "$hit_count" "$rep_score" "$category" "${attacks:0:40}"
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
echo "Press Ctrl+C to exit | Refreshing every 2 seconds..."
|
||||||
|
|
||||||
|
last_count=$current_count
|
||||||
|
last_update=$current_time
|
||||||
|
fi
|
||||||
|
|
||||||
|
sleep 2
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
# Main loop
|
||||||
|
main() {
|
||||||
|
while true; do
|
||||||
|
show_menu
|
||||||
|
read -r choice
|
||||||
|
|
||||||
|
case $choice in
|
||||||
|
1) query_ip_interactive ;;
|
||||||
|
2) view_top_malicious ;;
|
||||||
|
3) view_top_active ;;
|
||||||
|
4) view_statistics ;;
|
||||||
|
5) live_monitoring ;;
|
||||||
|
6) export_database_interactive ;;
|
||||||
|
7) cleanup_database_interactive ;;
|
||||||
|
8) rebuild_index_interactive ;;
|
||||||
|
9) flag_ip_interactive ;;
|
||||||
|
10) whitelist_ip_interactive ;;
|
||||||
|
11) import_log_interactive ;;
|
||||||
|
0)
|
||||||
|
clear
|
||||||
|
echo "Exiting..."
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
print_error "Invalid option"
|
||||||
|
sleep 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
# Run main
|
||||||
|
main
|
||||||
@@ -20,6 +20,7 @@
|
|||||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||||
source "$SCRIPT_DIR/lib/common-functions.sh"
|
source "$SCRIPT_DIR/lib/common-functions.sh"
|
||||||
source "$SCRIPT_DIR/lib/system-detect.sh"
|
source "$SCRIPT_DIR/lib/system-detect.sh"
|
||||||
|
source "$SCRIPT_DIR/lib/ip-reputation.sh"
|
||||||
|
|
||||||
# Require root
|
# Require root
|
||||||
if [ "$EUID" -ne 0 ]; then
|
if [ "$EUID" -ne 0 ]; then
|
||||||
@@ -341,6 +342,21 @@ process_threat_event() {
|
|||||||
local threat_level=$(classify_threat_level "${IP_COUNTER[$ip]}")
|
local threat_level=$(classify_threat_level "${IP_COUNTER[$ip]}")
|
||||||
IP_THREAT_LEVEL[$ip]="$threat_level"
|
IP_THREAT_LEVEL[$ip]="$threat_level"
|
||||||
|
|
||||||
|
# Track in centralized IP reputation database
|
||||||
|
# Map attack types to reputation flags
|
||||||
|
local rep_attack_type="SUSPICIOUS"
|
||||||
|
case "$attack_type" in
|
||||||
|
SSH_BRUTEFORCE) rep_attack_type="BRUTEFORCE" ;;
|
||||||
|
SQL_INJECTION) rep_attack_type="SQL_INJECTION" ;;
|
||||||
|
XSS_ATTACK) rep_attack_type="XSS" ;;
|
||||||
|
PATH_TRAVERSAL) rep_attack_type="PATH_TRAVERSAL" ;;
|
||||||
|
EXPLOIT) rep_attack_type="EXPLOIT" ;;
|
||||||
|
DDOS) rep_attack_type="DDOS" ;;
|
||||||
|
BOT) rep_attack_type="BOT" ;;
|
||||||
|
*) rep_attack_type="SCANNER" ;;
|
||||||
|
esac
|
||||||
|
flag_ip_attack "$ip" "$rep_attack_type" 0 "$attack_type: $details" >/dev/null 2>&1 &
|
||||||
|
|
||||||
# Log to feed
|
# Log to feed
|
||||||
log_event "$ip" "$attack_type" "$(get_threat_color "$threat_level")" "$details"
|
log_event "$ip" "$attack_type" "$(get_threat_color "$threat_level")" "$details"
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -9,6 +9,7 @@
|
|||||||
|
|
||||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||||
source "$SCRIPT_DIR/lib/common-functions.sh"
|
source "$SCRIPT_DIR/lib/common-functions.sh"
|
||||||
|
source "$SCRIPT_DIR/lib/ip-reputation.sh"
|
||||||
|
|
||||||
# Ensure color variables are set
|
# Ensure color variables are set
|
||||||
DIM='\033[2m'
|
DIM='\033[2m'
|
||||||
@@ -111,6 +112,8 @@ while IFS= read -r log; do
|
|||||||
line_lower="${line,,}"
|
line_lower="${line,,}"
|
||||||
if [[ "$line_lower" =~ (bot|crawler|spider|scanner|monitor|cloud|amazon|google|microsoft|azure) ]]; then
|
if [[ "$line_lower" =~ (bot|crawler|spider|scanner|monitor|cloud|amazon|google|microsoft|azure) ]]; then
|
||||||
((filtered_bots++))
|
((filtered_bots++))
|
||||||
|
# Track bot IP with BOT flag
|
||||||
|
flag_ip_attack "$ip" "BOT" 0 "500 error - filtered as bot/scanner" >/dev/null 2>&1 &
|
||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
@@ -119,14 +122,20 @@ while IFS= read -r log; do
|
|||||||
line_lower="${line,,}"
|
line_lower="${line,,}"
|
||||||
if [[ "$line_lower" =~ (bot|crawler|spider|scraper|scanner|check|monitor|uptime|pingdom|newrelic|datadog|nagios|zabbix|prtg|gomez|keynote|catchpoint|dotcom-monitor|site24x7|uptimerobot|statuscake|nodequery|hetrixtools|freshping|uptrendscom|siteuptime|montastic|updown\.io|apex|alertsite|webmon|wormly) ]]; then
|
if [[ "$line_lower" =~ (bot|crawler|spider|scraper|scanner|check|monitor|uptime|pingdom|newrelic|datadog|nagios|zabbix|prtg|gomez|keynote|catchpoint|dotcom-monitor|site24x7|uptimerobot|statuscake|nodequery|hetrixtools|freshping|uptrendscom|siteuptime|montastic|updown\.io|apex|alertsite|webmon|wormly) ]]; then
|
||||||
((filtered_bots++))
|
((filtered_bots++))
|
||||||
|
# Track monitoring/uptime bot
|
||||||
|
flag_ip_attack "$ip" "BOT" 0 "Monitoring/uptime bot" >/dev/null 2>&1 &
|
||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
if [[ "$line_lower" =~ (semrush|ahrefs|moz|majestic|serpstat|screaming|screamingfrog|sitebulb|linkchecker|validator|scanner|security|acunetix|nessus|openvas|burp|nikto|skipfish|w3af|sqlmap|metasploit|nmap|masscan|zmap|shodan|censys|binaryedge) ]]; then
|
if [[ "$line_lower" =~ (semrush|ahrefs|moz|majestic|serpstat|screaming|screamingfrog|sitebulb|linkchecker|validator|scanner|security|acunetix|nessus|openvas|burp|nikto|skipfish|w3af|sqlmap|metasploit|nmap|masscan|zmap|shodan|censys|binaryedge) ]]; then
|
||||||
((filtered_bots++))
|
((filtered_bots++))
|
||||||
|
# Track scanner with higher score
|
||||||
|
flag_ip_attack "$ip" "SCANNER" 0 "Security scanner detected" >/dev/null 2>&1 &
|
||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
if [[ "$line_lower" =~ (curl|wget|python|perl|ruby|java|go-http|libwww|axios|node-fetch|http\.client|httpie|postman|insomnia|apachehttp|okhttp|httpclient) ]]; then
|
if [[ "$line_lower" =~ (curl|wget|python|perl|ruby|java|go-http|libwww|axios|node-fetch|http\.client|httpie|postman|insomnia|apachehttp|okhttp|httpclient) ]]; then
|
||||||
((filtered_bots++))
|
((filtered_bots++))
|
||||||
|
# Track programmatic access
|
||||||
|
flag_ip_attack "$ip" "BOT" 0 "HTTP library/tool" >/dev/null 2>&1 &
|
||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
|
|
||||||
@@ -147,6 +156,10 @@ while IFS= read -r log; do
|
|||||||
((domain_count["$domain"]++))
|
((domain_count["$domain"]++))
|
||||||
((total_500s++))
|
((total_500s++))
|
||||||
|
|
||||||
|
# Track IP in reputation database (500 error = slight increase in score)
|
||||||
|
# Most 500s are due to server issues, not attacks, so low score increase
|
||||||
|
increment_ip_hits "$ip" 1 >/dev/null 2>&1 &
|
||||||
|
|
||||||
# Save for analysis
|
# Save for analysis
|
||||||
echo "$domain|$user|$status|$url|$timestamp|$ip" >> "$ERRORS_500"
|
echo "$domain|$user|$status|$url|$timestamp|$ip" >> "$ERRORS_500"
|
||||||
fi
|
fi
|
||||||
|
|||||||
@@ -12,6 +12,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|||||||
source "$SCRIPT_DIR/lib/common-functions.sh"
|
source "$SCRIPT_DIR/lib/common-functions.sh"
|
||||||
source "$SCRIPT_DIR/lib/system-detect.sh"
|
source "$SCRIPT_DIR/lib/system-detect.sh"
|
||||||
source "$SCRIPT_DIR/lib/user-manager.sh"
|
source "$SCRIPT_DIR/lib/user-manager.sh"
|
||||||
|
source "$SCRIPT_DIR/lib/ip-reputation.sh"
|
||||||
|
|
||||||
# Configuration
|
# Configuration
|
||||||
APACHE_ERROR_LOG="/var/log/apache2/error_log"
|
APACHE_ERROR_LOG="/var/log/apache2/error_log"
|
||||||
@@ -450,6 +451,11 @@ while IFS='|' read -r log_path log_type; do
|
|||||||
# Skip if bot/scanner
|
# Skip if bot/scanner
|
||||||
if is_noise "$line"; then
|
if is_noise "$line"; then
|
||||||
((filtered_out++))
|
((filtered_out++))
|
||||||
|
# Track bot/scanner IPs
|
||||||
|
read -r ip _ _ _ _ _ _ _ <<< "$line"
|
||||||
|
if [[ "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
||||||
|
flag_ip_attack "$ip" "BOT" 0 "Bot/scanner filtered in error analysis" >/dev/null 2>&1 &
|
||||||
|
fi
|
||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user