squidmagic is a tool designed to analyze a web-based network traffic to detect central command and control (C&C) servers and Malicious site, using Squid proxy server and Spamhaus.
usage
squidmagic # python squidmagic.py /var/log/squid3/access.log
_ _ _
(_) | | (_)
___ __ _ _ _ _ __| |_ __ ___ __ _ __ _ _ ___
/ __|/ _` | | | | |/ _` | '_ ` _ \ / _` |/ _` | |/ __|
\__ \ (_| | |_| | | (_| | | | | | | (_| | (_| | | (__
|___/\__, |\__,_|_|\__,_|_| |_| |_|\__,_|\__, |_|\___|
| | __/ |
|_| |___/
Analyzing...
Analyzing by SBL Advisory...
Spam server detected, ip is 65.182.101.221
Analyzing by SBL_CSS Advisory...
safe server detected, host or ip is 65.182.101.221
Analyzing by PBL Advisory...
safe server detected, host or ip is 65.182.101.221
Run server
<?php
namespace SquidApp\Core;
require dirname(__DIR__) . '/lib/vendor/autoload.php';
$banner = new \SquidApp\Squid();
$squidmagic = new FileSystem();
// output banner
echo $banner->bannerAction();
// Scans a directory for files
$squidmagic->scandirs('squidmagic/Collector path');
// Checks if file exists in certain location
$squidmagic->fileExists('Collector Path/server.php');
// run server
$squidmagic->openInBackground('Collector Path/lib/bin/');squidmagic/lib # php squidmagic.php
| |
___ __ _ _ _ _ __| |_ __ ___ __ _ __ _ _ ___
/ __|/ _` | | | | |/ _` | '_ ` _ \ / _` |/ _` | |/ __|
\__ \ (_| | |_| | | (_| | | | | | | (_| | (_| | | (__
|___/\__, |\__,_|_|\__,_|_| |_| |_|\__,_|\__, |_|\___|
| | __/ |
|_| |___/
squidmagic collector started
