MSRXTools / Incident response
Access log attack finder
Paste nginx or Apache access logs and find SQL injection, XSS, path traversal, Log4Shell, secret probing, scanners and login brute force, by IP.
Runs in your browser
Loading tool…
Good to know
- Almost every public server sees these probes daily. What matters is the “answered 2xx” list: attacks the server responded to successfully.
- Block persistent scanners at the firewall or CDN, and use rate limiting on login pages to stop brute force.
- nginx logs live in /var/log/nginx/access.log, Apache in /var/log/apache2/access.log or /var/log/httpd/access_log.