{"id":3266,"date":"2026-08-16T09:53:27","date_gmt":"2026-08-16T01:53:27","guid":{"rendered":"https:\/\/systw.net\/note\/?p=3266"},"modified":"2026-08-16T09:53:29","modified_gmt":"2026-08-16T01:53:29","slug":"web-log-analysis-concept","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/3266","title":{"rendered":"Web Log Analysis Concept"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">\u5c0b\u627e\u653b\u64ca\u8005\u9664\u4e86\u8981\u6709\u8cc7\u5b89\u6982\u5ff5\u5916\uff0c\u5206\u6790\u65b9\u6cd5\u4e5f\u662f\u91cd\u8981\u7684\u74b0\u7bc0\u3002Web Log\u5206\u6790\u7684\u65b9\u6cd5\u662f\u5c07\u300c\u5206\u6790\u65b9\u5411\uff08\u7531\u5927\u5230\u5c0f\u3001\u57fa\u6e96\u7dda\u3001\u6642\u5e8f\u3001\u540c\u5115\uff09\u300d\u8207\u300c\u65e5\u8a8c\u5c6c\u6027\uff08URL\u3001Status\u3001Method\u3001UA\u3001Referer\uff09\u300d\u505a\u77e9\u9663\u5f0f\u642d\u914d\uff0c\u518d\u843d\u5be6\u5230\u300c\u5831\u544a\u64b0\u5beb\uff08\u6458\u8981\u3001\u5b8f\u89c0\u6210\u56e0\u3001\u5fae\u89c0 IP \u8207\u8b49\u64da\u4f50\u8b49\uff09\u300d\uff0c\u624d\u80fd\u6210\u70ba\u7d50\u69cb\u5b8c\u6574\u3001\u908f\u8f2f\u6e05\u6670\u4e14\u5177\u5099\u5be6\u52d9\u50f9\u503c\u7684\u5206\u6790\u7d50\u679c\u3002<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e00 Web Log \u7570\u5e38\u5206\u6790  <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee5\u4e0b\u662f\u5e7e\u500b\u5e38\u898b\u7684\u5206\u6790\u65b9\u5411<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. \u5f9e\u4e0a\u5230\u4e0b\u770b\uff08Top-Down &amp; Aggregation Analysis\uff09<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u6982\u5ff5\u8aaa\u660e<\/strong>\uff1a\u9762\u5c0d\u6578\u767e\u842c\u7b46\u6d77\u91cf Log\uff0c\u5207\u5fcc\u5f9e\u7b2c 1 \u7b46\u958b\u59cb\u9010\u884c\u7d30\u8b80\u3002\u5fc5\u9808\u5148\u900f\u904e\u5716\u8868\u6216 <code>GROUP BY<\/code> \u805a\u5408\u529f\u80fd\u62c9\u51fa\u5168\u57df\u7d71\u8a08\uff0c\u627e\u51fa\u300c\u6975\u5927\u503c\uff08Top 10\uff09\u300d\u6216\u300c\u6975\u5c0f\u503c\uff08Rare\/Outlier\uff09\u300d\uff0c\u518d\u4e0b\u947d\uff08Drill-down\uff09\u53bb\u770b\u500b\u5225 Log \u7684\u7d30\u7bc0\u3002<\/li>\n\n\n\n<li><strong>\u5be6\u4f8b<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li><strong>\u770b Top 10 IP<\/strong>\uff1a\u7d71\u8a08\u767c\u73fe\u7b2c 1 \u540d\u7684 IP \u5360\u4e86\u5168\u7ad9 35% \u6d41\u91cf\u3002\u4e0b\u947d\u767c\u73fe\u8a72 IP \u5728 1 \u5c0f\u6642\u5167\u5c0d <code>\/api\/v1\/login<\/code> \u767c\u9001\u6578\u842c\u6b21 <code>POST<\/code> \u8acb\u6c42\uff08\u5e33\u5bc6\u66b4\u529b\u7834\u89e3 \/ Credential Stuffing\uff09\u3002<\/li>\n\n\n\n<li><strong>\u770b Top 10 Status Code<\/strong>\uff1a\u7d71\u8a08\u767c\u73fe <code>HTTP 404<\/code> \u5360\u4e86\u5168\u7ad9\u6d41\u91cf 65%\u3002\u4e0b\u947d\u67e5\u770b\u5c0d\u61c9\u7684 URL\uff0c\u767c\u73fe\u5168\u662f <code>.env<\/code>\u3001<code>wp-config.php.bak<\/code> \u6216 <code>\/admin\/<\/code>\uff0c\u78ba\u8a8d\u70ba\u81ea\u52d5\u5316\u5f31\u9ede\u6383\u63cf\u3002<\/li>\n\n\n\n<li><strong>\u770b\u6975\u5c0f\u503c\uff08Bottom 10\uff09<\/strong>\uff1a\u7d71\u8a08 <code>User-Agent<\/code>\uff0c\u5168\u7ad9 99% \u662f\u4e3b\u6d41\u700f\u89bd\u5668\uff0c\u4f46\u51fa\u73fe 1 \u7b46\u53ea\u51fa\u73fe\u904e 1 \u6b21\u7684 UA\uff0c\u5167\u5bb9\u5305\u542b <code>${jndi:ldap:\/\/...}<\/code>\uff08Log4Shell \u6f0f\u6d1e\u8a66\u63a2\uff09\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2. \u4e86\u89e3\u5e73\u5e38\u7684\u6a23\u5b50\uff08\u5efa\u7acb\u57fa\u6e96\u7dda Baseline\uff09<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u6982\u5ff5\u8aaa\u660e<\/strong>\uff1a\u6c92\u6709\u5b9a\u7fa9\u300c\u6b63\u5e38\u300d\uff0c\u5c31\u7121\u6cd5\u8fa8\u8b58\u300c\u7570\u5e38\u300d\u3002\u5206\u6790\u5e2b\u5fc5\u9808\u5148\u638c\u63e1\u7cfb\u7d71\u5728\u5e73\u6642\u71df\u904b\u6642\u7684\u57fa\u7dda\uff08Baseline\uff09\uff0c\u5305\u542b\u8acb\u6c42\u65b9\u6cd5\u6bd4\u4f8b\u3001\u5e38\u898f\u56de\u61c9\u5927\u5c0f\u8207\u6d41\u91cf\u6ce2\u52d5\u7bc4\u570d\u3002<\/li>\n\n\n\n<li><strong>\u5be6\u4f8b<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li><strong>Method \u6bd4\u4f8b\u57fa\u7dda<\/strong>\uff1a\u5e73\u65e5\u7db2\u7ad9\u6d41\u91cf\u6bd4\u4f8b\u70ba <code>GET (85%)<\/code>\u3001<code>POST (15%)<\/code>\u3002\u82e5\u67d0\u5929 <code>POST<\/code> \u6bd4\u4f8b\u7a81\u7136\u98c6\u5347\u81f3 70%\uff0c\u6216\u7a81\u7136\u51fa\u73fe\u5e73\u65e5\u6c92\u6709\u7684 <code>PUT\/DELETE\/OPTIONS<\/code>\uff0c\u5373\u70ba\u7570\u5e38\u3002<\/li>\n\n\n\n<li><strong>\u56de\u61c9\u50b3\u8f38\u91cf\uff08Bytes Sent\uff09\u57fa\u7dda<\/strong>\uff1a\u500b\u8cc7\u67e5\u8a62 API\uff08<code>\/api\/get_user_info<\/code>\uff09\u5e73\u6b21\u56de\u50b3\u5927\u5c0f\u901a\u5e38\u5728 2 KB ~ 5 KB\u3002\u82e5 Log \u4e2d\u8a72 API \u56de\u50b3\u4e86 50 MB\uff0c\u6975\u53ef\u80fd\u767c\u751f\u4e86 SQL \u6ce8\u5165\u5168\u8868\u62d6\u5eab\uff08Data Exfiltration\uff09\u6216\u4efb\u610f\u6a94\u6848\u4e0b\u8f09\uff08LFI\uff09\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3. \u6642\u9593\u6bd4\u8f03\u5206\u6790\uff08\u8da8\u52e2\u8207\u9031\u671f\u5206\u6790\uff09<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u6982\u5ff5\u8aaa\u660e<\/strong>\uff1a\u5c07\u7576\u524d\u6642\u6bb5\uff08\u5982\u6700\u5f8c 24 \u5c0f\u6642\uff09\u8207\u6b77\u53f2\u9031\u671f\uff08\u904e\u53bb 7 \u5929\u300130 \u5929\uff09\u9032\u884c\u6bd4\u5c0d\uff0c\u5c0b\u627e\u6642\u9593\u8ef8\u4e0a\u7684<strong>\u7a81\u6ce2\uff08Spike\uff09\u6216\u96e2\u5cf0\u6642\u6bb5\u7684\u7570\u5e38\u884c\u70ba<\/strong>\u3002<\/li>\n\n\n\n<li><strong>\u5be6\u4f8b<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li><strong>\u6700\u8fd1 24 \u5c0f\u6642\uff08\u77ed\u671f\u96e2\u5cf0\u7a81\u6ce2\uff09<\/strong>\uff1a\u5e73\u65e5\u51cc\u6668 3:00~4:00 \u6d41\u91cf\u70ba\u5168\u5929\u6700\u4f4e\uff08\u6bcf\u5206\u9418\u4e0d\u5230 30 \u7b46\uff09\uff0c\u4f46\u4eca\u65e5\u51cc\u6668 3:00 \u7a81\u7136\u98c6\u5347\u81f3\u6bcf\u5206\u9418 2 \u842c\u7b46\uff0c\u4e14\u96c6\u4e2d\u5728\u5c11\u6578 API\uff0c\u901a\u5e38\u70ba\u6392\u7a0b\u8173\u672c\u6216\u6d77\u5916\u653b\u64ca\u8005\u5728\u96e2\u5cf0\u671f\u767c\u52d5\u653b\u64ca\u3002<\/li>\n\n\n\n<li><strong>7 \u5929 \/ 30 \u5929\uff08\u9577\u9031\u671f\u6bd4\u8f03\uff09<\/strong>\uff1a\u6bd4\u8f03 30 \u5929\u5167\u300c\u6bcf\u65e5\u7368\u7acb IP \u6578\uff08Unique IPs\uff09\u300d\u8207\u300c\u7e3d\u8acb\u6c42\u6578\u300d\u3002\u82e5\u67d0\u5929\u7368\u7acb IP \u6578\u6c92\u6709\u589e\u9577\uff0c\u4f46\u7e3d\u8acb\u6c42\u6578\u66b4\u589e 10 \u500d\uff0c\u4ee3\u8868\u662f\u5c11\u6578\u7279\u5b9a IP \u767c\u52d5\u7684\u9ad8\u983b\u653b\u64ca\uff08\u5982 CC \u653b\u64ca\/\u722c\u87f2\uff09\uff0c\u800c\u975e\u771f\u5be6\u4f7f\u7528\u8005\u6210\u9577\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4. \u548c\u5225\u7684 IP \u6bd4\u8f03\uff08\u540c\u5115\u5206\u6790\uff09<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u6982\u5ff5\u8aaa\u660e<\/strong>\uff1a\u5c07\u55ae\u4e00 IP \u7684\u5c6c\u6027\u7279\u5fb5\u8207\u300c\u5168\u7ad9\u4f7f\u7528\u8005\u7fa4\u9ad4\u300d\u505a\u6a6b\u5411\u4ea4\u53c9\u6bd4\u5c0d\uff0c\u627e\u51fa\u504f\u96e2\u5e38\u614b\u7684IP\u3002<\/li>\n\n\n\n<li><strong>\u5be6\u4f8b<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li><strong>URL \u8c50\u5bcc\u5ea6\uff08Diversity\uff09\u5c0d\u6bd4<\/strong>\uff1a\u6b63\u5e38\u4f7f\u7528\u8005\u6703\u8f09\u5165 HTML\u3001CSS\u3001JS\u3001\u5716\u7247\u8207\u591a\u500b API\uff081 \u5c0f\u6642\u5167\u5b58\u53d6\u6578\u5341\u500b\u4e0d\u540c URL\uff09\uff1b\u67d0 IP \u767c\u9001 2,000 \u6b21\u8acb\u6c42\u537b <strong>100% \u53ea\u5b58\u53d6 1 \u500b URL<\/strong>\uff08\u5982 <code>\/cart\/checkout<\/code>\uff09\uff0c\u70ba\u5178\u578b\u7684\u6436\u8cfc\/\u6436\u7968 Bot\u3002<\/li>\n\n\n\n<li><strong>Header \u7d44\u5408\u5c0d\u6bd4<\/strong>\uff1a99% \u7684\u6b63\u5e38 IP \u5728\u767c\u9001 <code>POST<\/code> \u6642\u90fd\u6703\u5e36\u6709 <code>Referer<\/code> \u8207\u6a19\u6e96\u700f\u89bd\u5668 <code>User-Agent<\/code>\uff1b\u82e5\u67d0 IP \u767c\u9001 <code>POST<\/code> \u6642 <code>Referer<\/code> \u70ba\u7a7a\u767d\uff0c\u4e14 <code>User-Agent<\/code> \u70ba <code>python-requests\/2.31<\/code> \u6216\u7a7a\u767d\uff0c\u5373\u70ba\u672a\u7d93\u507d\u88dd\u7684\u81ea\u52d5\u5316\u8173\u672c\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Web Log \u8981\u95dc\u6ce8\u7684\u5c6c\u6027 <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u5c07\u4e0a\u8ff0\u5206\u6790\u65b9\u5411\u8207\u5e38\u898bWeb Log \u95dc\u9375\u5c6c\u6027\u9032\u884c\u77e9\u9663\u5f0f\u4ea4\u53c9\uff0c\u80fd\u7cbe\u6e96\u9396\u5b9a\u5404\u985e\u578b\u7684\u653b\u64ca\u7279\u5fb5\uff0c\u5e38\u898b\u5c6c\u6027\u6709URL, HTTP Status, Method, Useragent, Referer\u7b49\uff0c\u8209\u4f8b\u5982\u4e0b\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td><strong>\u95dc\u6ce8\u5c6c\u6027<\/strong><\/td><td><strong>\u6838\u5fc3\u95dc\u6ce8\u9ede<\/strong><\/td><td><strong>\u4ea4\u53c9\u5206\u6790\u7bc4\u4f8b\uff08\u7570\u5e38\u7279\u5fb5\uff09<\/strong><\/td><\/tr><\/thead><tbody><tr><td><strong>URL (Request Path)<\/strong><\/td><td>\u5b58\u53d6\u8def\u5f91\u662f\u5426\u654f\u611f\u3001\u53c3\u6578\u9577\u5ea6\u3001\u662f\u5426\u542b\u7279\u6b8a\u5b57\u5143<\/td><td>\u5305\u542b <code>..\/..<\/code>\uff08\u8def\u5f91\u904d\u6b77\uff09\u3001<code>UNION SELECT<\/code>\uff08SQLi\uff09\u3001<code>\/admin\/<\/code>\u3001<code>.git\/<\/code>\uff08\u76ee\u9304\u63a2\u6e2c\uff09\u3002<\/td><\/tr><tr><td><strong>HTTP Status Code<\/strong><\/td><td>\u56de\u61c9\u72c0\u614b\u78bc\u5206\u5e03\uff08200, 30x, 401, 403, 404, 500\uff09<\/td><td>404 \u6bd4\u4f8b\u904e\u9ad8\uff08\u6383\u63cf\uff09\uff1b401\/403 \u6fc0\u589e\uff08\u6b0a\u9650\u8a66\u63a2\uff09\uff1b\u51fa\u73fe\u5927\u91cf 500\uff08\u61c9\u7528\u7a0b\u5f0f\u5d29\u6f70\u6216 SQL \u932f\u8aa4\u6ce8\u5165\uff09\u3002<\/td><\/tr><tr><td><strong>HTTP Method<\/strong><\/td><td>\u8acb\u6c42\u65b9\u6cd5\uff08GET, POST, PUT, DELETE, OPTIONS, HEAD\uff09<\/td><td>\u5c0d\u975c\u614b\u5716\u6a94\uff08<code>.jpg<\/code>\uff09\u767c\u9001 <code>POST<\/code>\uff08Webshell \u8abf\u7528\uff09\uff1b\u51fa\u73fe\u7f55\u898b\u7684 <code>PUT\/DELETE<\/code>\uff08\u4f01\u5716\u5beb\u5165\/\u522a\u9664\u6a94\u6848\uff09\u3002<\/td><\/tr><tr><td><strong>User-Agent (UA)<\/strong><\/td><td>\u5ba2\u6236\u7aef\u8edf\u9ad4\u7279\u5fb5\u3001\u7248\u672c\u865f\u3001\u9577\u5ea6<\/td><td>\u51fa\u73fe <code>sqlmap<\/code>\u3001<code>Nikto<\/code>\u3001<code>Go-http-client<\/code>\u3001<code>python-requests<\/code>\uff0c\u6216 UA \u5167\u85cf\u6709 <code>${jndi:<\/code> \/ \u547d\u4ee4\u5217\u4ee3\u78bc\u3002<\/td><\/tr><tr><td><strong>Referer<\/strong><\/td><td>\u8acb\u6c42\u4f86\u6e90\u9801\u9762<\/td><td>\u654f\u611f\u64cd\u4f5c\uff08\u5982\u4ed8\u6b3e\u3001\u4fee\u6539\u5bc6\u78bc\uff09\u7121 Referer\uff08CSRF\/\u8173\u672c\u76f4\u9023\uff09\uff1b\u6216 Referer \u6307\u5411\u5916\u90e8\u53ef\u7591\u91e3\u9b5a\u7db2\u7ad9\u3002<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u4e8c \u5831\u544a\u64b0\u5beb\u67b6\u69cb <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u64b0\u5beb\u8cc7\u5b89\u5206\u6790\u5831\u544a\u6642\uff0c\u61c9\u9075\u5faa\u300c\u5148\u5beb\u6458\u8981 -> \u518d\u5206\u6790\u5b8f\u89c0\u7570\u5e38\u6210\u56e0 -> \u6700\u5f8c\u6df1\u5165\u53ef\u7591 IP \u5c6c\u6027\u8207\u8b49\u64da\u4f50\u8b49\u300d\u7684\u5c64\u6b21\u3002<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>\u5148\u5b8f\u89c0\u518d\u5fae\u89c0<\/strong>\uff1a\u5148\u7528\u7d71\u8a08\u8207\u5716\u8868\u8aaa\u670d\u8b80\u8005\u300c\u767c\u751f\u4e86\u4ec0\u9ebc\u7570\u5e38\u300d\uff0c\u518d\u7528\u55ae\u7b46 Log\u300c\u8b49\u5be6\u662f\u8ab0\u505a\u7684\u300d\u3002<\/li>\n\n\n\n<li><strong>\u6578\u64da\u8981\u6709\u5c0d\u7167\u7d44<\/strong>\uff1a\u55ae\u5beb\u300c\u6b64 IP \u767c\u9001\u4e86 4 \u842c\u6b21\u8acb\u6c42\u300d\u8aaa\u670d\u529b\u4e0d\u8db3\uff1b\u5beb\u51fa\u300c\u5168\u7ad9\u5e73\u5747\u55ae IP \u70ba 50 \u6b21\uff0c\u8a72 IP \u70ba\u5e73\u5747\u503c\u7684 800 \u500d\u300d\uff0c\u80fd\u66f4\u7cbe\u78ba\u51f8\u986f\u5176\u7570\u5e38\u7a0b\u5ea6\u3002<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">\u3010\u7bc4\u672c\u3011Web Log \u8cc7\u5b89\u5a01\u8105\u5206\u6790\u5831\u544a<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">1. \u57f7\u884c\u6458\u8981\uff08Executive Summary\uff09<\/h4>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u672c\u6b21\u5206\u6790\u5340\u9593\u70ba 2026\/08\/15 00:00 \u81f3 2026\/08\/15 12:00\u3002\u5206\u6790\u671f\u9593\u76e3\u6e2c\u5230\u986f\u8457\u6d41\u91cf\u7570\u5e38\uff0c\u5171\u767c\u73fe 1 \u500b\u9ad8\u98a8\u96aa\u653b\u64ca IP\uff08<code>198.51.100.45<\/code>\uff09\uff0c\u8a72\u4f86\u6e90\u91dd\u5c0d\u5f8c\u53f0\u7ba1\u7406\u4ecb\u9762\u8207\u5099\u4efd\u8def\u5f91\u9032\u884c\u5927\u898f\u6a21\u81ea\u52d5\u5316\u76ee\u9304\u5217\u8209\u8207\u5f31\u9ede\u6383\u63cf\uff0c\u7d2f\u8a08\u767c\u9001\u903e 42,000 \u6b21\u60e1\u610f\u8acb\u6c42\u3002\u76ee\u524d\u53d7\u6e2c\u8def\u5f91\u5747\u56de\u50b3 404\/403\uff0c\u5c1a\u672a\u767c\u73fe\u653b\u64ca\u6210\u529f\u7a81\u7834\u4e4b\u8de1\u8c61\uff0c\u5efa\u8b70\u5df2\u65bc\u9632\u706b\u7246\u5c01\u9396\u8a72 IP\u3002<\/p>\n<\/blockquote>\n\n\n\n<h4 class=\"wp-block-heading\">2. \u5b8f\u89c0\u7570\u5e38\u5206\u6790\u8207\u5c0e\u56e0\uff08Macro Anomalies &amp; Root Cause\uff09<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u5b8f\u89c0\u7570\u5e38\u767c\u73fe<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li>\u4eca\u65e5\u51cc\u6668 02:00 ~ 03:30 \u671f\u9593\uff0c\u5168\u7ad9 <code>HTTP 404 Not Found<\/code> \u56de\u61c9\u6578\u66b4\u589e\u81f3 42,310 \u6b21\uff0c\u5360\u8a72\u6642\u6bb5\u7e3d\u8acb\u6c42\u91cf\u7684 82%\uff08\u5e73\u65e5\u6b77\u53f2\u57fa\u7dda\u50c5\u70ba 1.5%\uff09\u3002<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>\u7570\u5e38\u69cb\u6210\u8207\u624b\u6cd5\u89e3\u6790<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li>\u7d93\u805a\u5408\u95dc\u806f\u5206\u6790\uff0c\u8a72\u7a81\u6ce2\u96c6\u4e2d\u5728\u55ae\u4e00\u4f86\u6e90 IP  <code>198.51.100.45<\/code> \u5c0d\u975e\u516c\u958b\u8def\u5f91\u7684\u5927\u91cf\u8a66\u63a2\u3002\u653b\u64ca\u8005\u4f7f\u7528\u81ea\u52d5\u5316\u5b57\u5178\u6a94\u6383\u63cf\u5de5\u5177\uff0c\u5feb\u901f\u5217\u8209\u5982 <code>.env<\/code>\u3001<code>wp-config.php.bak<\/code>\u3001<code>\/admin\/config.json<\/code> \u7b49\u654f\u611f\u6a94\u6848\uff0c\u7531\u65bc\u76ee\u6a19\u6a94\u6848\u5728\u4f3a\u670d\u5668\u4e0a\u5747\u4e0d\u5b58\u5728\uff0c\u56e0\u800c\u89f8\u767c\u5927\u91cf 404 \u72c0\u614b\u78bc\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">3. \u7591\u4f3c\u653b\u64ca IP \u8a73\u7d30\u5256\u6790\uff08Suspect IP Profile &amp; Evidence\uff09<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\">\u8cc7\u8a0a\u4e00\uff1a\u548c IP \u76f8\u95dc\u7684\u65e5\u8a8c\u5c6c\u6027\u4ecb\u7d39\uff08IP Attributes\uff09<\/h5>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td><strong>\u5c6c\u6027\u9805\u76ee<\/strong><\/td><td><strong>\u65e5\u8a8c\u7d00\u9304 \/ \u5206\u6790\u7d50\u679c<\/strong><\/td><\/tr><\/thead><tbody><tr><td><strong>\u53ef\u7591 IP<\/strong><\/td><td><code>198.51.100.45<\/code><\/td><\/tr><tr><td><strong>\u5730\u7406\u4f4d\u7f6e \/ \u6240\u5c6c ISP<\/strong><\/td><td>\u7f8e\u570b (US) \/ DigitalOcean \u96f2\u7aef\u6a5f\u623f<\/td><\/tr><tr><td><strong>\u5a01\u8105\u60c5\u8cc7\u6a19\u7c64<\/strong><\/td><td>\u6a19\u8a18\u70ba Known Malicious Scanner \/ Tor Exit Node<\/td><\/tr><tr><td><strong>\u4e3b\u8981\u6d3b\u52d5\u6642\u9593<\/strong><\/td><td>2026-08-15 02:15:20 ~ 03:42:11\uff08\u6301\u7e8c\u7d04 1.5 \u5c0f\u6642\uff09<\/td><\/tr><tr><td><strong>\u4e3b\u8981 User-Agent<\/strong><\/td><td><code>Go-http-client\/1.1<\/code> (Go \u8a9e\u8a00\u81ea\u52d5\u5316\u5957\u4ef6\u9810\u8a2d\u503c)<\/td><\/tr><tr><td><strong>\u4e3b\u8981 Referer<\/strong><\/td><td><em>(\u7a7a\u767d\u672a\u586b\u5beb)<\/em><\/td><\/tr><tr><td><strong>\u8acb\u6c42\u65b9\u6cd5\uff08Method\uff09<\/strong><\/td><td><code>GET<\/code> (99.2%)\u3001<code>POST<\/code> (0.8%)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h5 class=\"wp-block-heading\">\u8cc7\u8a0a\u4e8c\uff1a\u5224\u5b9a\u7570\u5e38\u539f\u56e0\u8207\u4f50\u8b49\u622a\u5716\uff08Root Cause &amp; Screenshots\uff09<\/h5>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u5224\u5b9a\u7570\u5e38\u539f\u56e0<\/strong>\uff1a\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>\u8acb\u6c42\u983b\u7387\u9060\u8d85\u5e38\u4eba<\/strong>\uff1a\u8a72 IP \u65bc 1.5 \u5c0f\u6642\u5167\u767c\u9001 42,000 \u6b21\u8acb\u6c42\uff0c\u5e73\u5747\u6bcf\u79d2\u9ad8\u9054 7.7 \u6b21\uff0c\u9060\u9ad8\u65bc\u6b63\u5e38\u4f7f\u7528\u8005\u884c\u70ba\u6a21\u5f0f\uff08\u6b63\u5e38\u55ae IP \u6bcf\u5c0f\u6642\u5c11\u65bc 100 \u6b21\uff09\u3002<\/li>\n\n\n\n<li><strong>\u72c0\u614b\u78bc\u5206\u5e03\u6975\u7aef<\/strong>\uff1a\u8a72 IP \u8acb\u6c42\u4e4b <code>HTTP 404<\/code> \u6bd4\u4f8b\u9054 98%\uff0c\u5177\u5099\u660e\u78ba\u7684\u76ee\u9304\u5217\u8209\u7279\u5fb5\u3002<\/li>\n\n\n\n<li><strong>\u6a19\u982d\u7279\u5fb5\u7b26\u5408\u8173\u672c<\/strong>\uff1a\u6240\u6709\u8acb\u6c42\u7686\u7121 <code>Referer<\/code>\uff0c\u4e14 <code>User-Agent<\/code> \u70ba\u672a\u7d93\u507d\u88dd\u4e4b\u958b\u767c\u5957\u4ef6\u6a19\u982d\u3002<\/li>\n<\/ol>\n<\/li>\n\n\n\n<li><strong>\u76f8\u95dc\u4f50\u8b49\u622a\u5716<\/strong>\uff1a\n<ul class=\"wp-block-list\">\n<li><strong>\u3010\u4f50\u8b49\u5716 1\uff1aTop IP \u6d41\u91cf\u8207\u72c0\u614b\u78bc\u7d71\u8a08\u5716\u3011<\/strong><br><em>(\u6b64\u8655\u9644\u4e0a SIEM \/ Kibana \/ Grafana \u805a\u5408\u5716\u8868\uff0c\u6a19\u8a18\u8a72 IP \u7684\u6d41\u91cf\u67f1\u72c0\u5716\u8207 404 \u5360\u6bd4\u96e2\u7fa4\u72c0\u6cc1)<\/em><\/li>\n\n\n\n<li><strong>\u3010\u4f50\u8b49\u5716 2\uff1a\u539f\u59cb\u65e5\u8a8c\uff08Raw Log\uff09\u63a1\u6a23\u622a\u5716\u3011<\/strong><br><em>(\u6b64\u8655\u9644\u4e0a 3~5 \u7b46\u539f\u59cb\u65e5\u8a8c\u622a\u5716\uff0c\u7d05\u6846\u6a19\u8a18 Timestamp\u3001Client IP\u3001\u8acb\u6c42\u8def\u5f91\u5982 <code>\/admin\/.env<\/code>\u3001\u72c0\u614b\u78bc <code>404<\/code> \u53ca User-Agent <code>Go-http-client\/1.1<\/code>)<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u5c0b\u627e\u653b\u64ca\u8005\u9664\u4e86\u8981\u6709\u8cc7\u5b89\u6982\u5ff5\u5916\uff0c\u5206\u6790\u65b9\u6cd5\u4e5f\u662f\u91cd\u8981\u7684\u74b0\u7bc0\u3002Web Log\u5206\u6790\u7684\u65b9\u6cd5\u662f\u5c07\u5206\u6790\u65b9\u5411\u8207\u65e5\u8a8c\u5c6c\u6027\u505a\u77e9\u9663\u5f0f\u642d\u914d\uff0c\u518d\u843d\u5be6\u5230\u5831\u544a\u64b0\u5beb\uff0c\u624d\u80fd\u6210\u70ba\u7d50\u69cb\u5b8c\u6574\u3001\u908f\u8f2f\u6e05\u6670\u4e14\u5177\u5099\u5be6\u52d9\u50f9\u503c\u7684\u5206\u6790\u7d50\u679c\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[10],"tags":[],"class_list":["post-3266","post","type-post","status-publish","format-standard","hentry","category-securitysloution"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":2923,"url":"https:\/\/systw.net\/note\/archives\/2923","url_meta":{"origin":3266,"position":0},"title":"Web\u6ef2\u900f\u6e2c\u8a66\u5be6\u52d9","author":"raymond","date":"2025 \u5e74 12 \u6708 20 \u65e5","format":false,"excerpt":"\u672c\u8ab2\u7a0b\u5c08\u70ba\u8cc7\u5b89\u521d\u5b78\u8005\u8207\u60f3\u8f49\u8077\u6ef2\u900f\u6e2c\u8a66\u7684\u6280\u8853\u4eba\u54e1\u8a2d\u8a08\u3002\u900f\u904e \u300c\u7406\u8ad6\u5c0e\u5f15\u3001\u5de5\u5177\u719f\u7df4\u3001\u6f0f\u6d1e\u5be6\u8e10\u3001\u9776\u5834\u5be6\u6230\u300d\u2026","rel":"","context":"\u5728\u300c\u5b89\u5168\u89e3\u6c7a\u65b9\u6848\u300d\u4e2d","block_context":{"text":"\u5b89\u5168\u89e3\u6c7a\u65b9\u6848","link":"https:\/\/systw.net\/note\/archives\/category\/securitysloution"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":451,"url":"https:\/\/systw.net\/note\/archives\/451","url_meta":{"origin":3266,"position":1},"title":"Data Warehouse and OLAP","author":"raymond","date":"2012 \u5e74 12 \u6708 30 \u65e5","format":false,"excerpt":"DW(data warehouse,\u8cc7\u6599\u5009\u5132)\u76ee\u5730:\u5c07\u4e0d\u540c\u4f86\u6e90\u8cc7\u6599\u6574\u5408\u8d77\u4f86,\u627e\u51fa\u5171\u901a\u6027\u4ee5\u5354\u52a9\u505a\u6c7a\u7b56D\u2026","rel":"","context":"\u5728\u300c\u6578\u64da\u5206\u6790\u300d\u4e2d","block_context":{"text":"\u6578\u64da\u5206\u6790","link":"https:\/\/systw.net\/note\/archives\/category\/dataanalysis"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3032,"url":"https:\/\/systw.net\/note\/archives\/3032","url_meta":{"origin":3266,"position":2},"title":"Red Teaming","author":"raymond","date":"2026 \u5e74 1 \u6708 1 \u65e5","format":false,"excerpt":"Red Team\uff08\u7d05\u968a\uff09\u662f\u6307\u4e00\u500b\u7372\u5f97\u6388\u6b0a\u7684\u5718\u968a\uff0c\u5c0d\u7d44\u7e54\u7684\u7cfb\u7d71\u3001\u6d41\u7a0b\u3001\u4eba\u54e1\u6216\u7269\u7406\u5b89\u5168\u9032\u884c\u653b\u64ca\u6a21\u64ec\u3002\u76ee\u6a19\u2026","rel":"","context":"\u5728\u300c\u5b89\u5168\u89e3\u6c7a\u65b9\u6848\u300d\u4e2d","block_context":{"text":"\u5b89\u5168\u89e3\u6c7a\u65b9\u6848","link":"https:\/\/systw.net\/note\/archives\/category\/securitysloution"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3170,"url":"https:\/\/systw.net\/note\/archives\/3170","url_meta":{"origin":3266,"position":3},"title":"Attack Surface Management","author":"raymond","date":"2026 \u5e74 5 \u6708 1 \u65e5","format":false,"excerpt":"\u653b\u64ca\u9762\u7ba1\u7406\uff08Attack Surface Management, ASM\uff09\u7c21\u55ae\u4f86\u8aaa\uff0c\u5b83\u662f\u5f9e\u653b\u64ca\u8005\u7684\u8996\u2026","rel":"","context":"\u5728\u300c\u5b89\u5168\u89e3\u6c7a\u65b9\u6848\u300d\u4e2d","block_context":{"text":"\u5b89\u5168\u89e3\u6c7a\u65b9\u6848","link":"https:\/\/systw.net\/note\/archives\/category\/securitysloution"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2479,"url":"https:\/\/systw.net\/note\/archives\/2479","url_meta":{"origin":3266,"position":4},"title":"Cyber Kill Chain","author":"raymond","date":"2024 \u5e74 8 \u6708 3 \u65e5","format":false,"excerpt":"\u7db2\u8def\u653b\u64ca\u93c8\u662fLockheed Martin\u63d0\u51fa\u7684\u8cc7\u5b89\u653b\u9632\u67b6\u69cb\uff0c\u65e8\u5728\u5354\u52a9\u9632\u79a6\u8005\u8b58\u5225\u8207\u963b\u6b62\u99ed\u5ba2\u5165\u4fb5\u884c\u52d5\u3002\u2026","rel":"","context":"\u5728\u300cConcept\u300d\u4e2d","block_context":{"text":"Concept","link":"https:\/\/systw.net\/note\/archives\/category\/hackerthreat\/concept"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":447,"url":"https:\/\/systw.net\/note\/archives\/447","url_meta":{"origin":3266,"position":5},"title":"IDS and IPS","author":"raymond","date":"2015 \u5e74 10 \u6708 24 \u65e5","format":false,"excerpt":"IDS(intrusion detection system,\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71)\u662f\u4e00\u7a2e\u76e3\u6e2c\u8207\u8b58\u5225\u672a\u7d93\u6388\u6b0a\u2026","rel":"","context":"\u5728\u300c\u5b89\u5168\u89e3\u6c7a\u65b9\u6848\u300d\u4e2d","block_context":{"text":"\u5b89\u5168\u89e3\u6c7a\u65b9\u6848","link":"https:\/\/systw.net\/note\/archives\/category\/securitysloution"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/3266","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=3266"}],"version-history":[{"count":1,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/3266\/revisions"}],"predecessor-version":[{"id":3267,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/3266\/revisions\/3267"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=3266"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=3266"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=3266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}