Home

---

Download

---

Install

1. get the latest version of PHPIDS, move webforensik.php to your PHPIDS lib/ directory or adjust $phpids_lib_path
2. (optional) if you consider using dns lookups (-h), you might want to run a local, caching nameserver like dnsmasq to increase performance
3. run ./webforensik.php access.log

---

Configure

you can define your own Apache mod_log_config style logline formats, e.g.

'custom' => '%h %l %u %t \"%r\" %>s %b %{X-Forwarded-For}'

---

Usage

Usage: webforensik [-i input_type] [-o output_type]
                   [-h] input_logfile [output_file]

-i allowed input types: common combined combinedio cookie vhost
-o allowed output types: csv html xml
-h resolve hostnames

---

Papers

• WebForensik - Forensische Analyse von Apache HTTPD Logfiles (German)