不過(guò)，目前的日志分析工具并不是很完善，有些功能并不具備，特別是針對(duì)某個(gè)URL地址進(jìn)行攻擊的分析并不多，下面是一個(gè)VB Script程序，保存為VBS程序后可以在服務(wù)器上運(yùn)行，用于分析和檢測(cè)IIS日志里針對(duì)某個(gè)URL地址進(jìn)行攻擊的IP地址。
targeturl = "/archives/2761.html" '受攻擊網(wǎng)站的URL地址。
logfilepath = "C:\LogFiles\W3SVC\ex110813.log" '受攻擊網(wǎng)站的日志路徑。
On Error Resume Next
Set fileobj = CreateObject("scripting.filesystemobject")
Set fileobj2 = CreateObject("scripting.filesystemobject")
Set myfile = fileobj2.opentextfile(logfilepath, 1, False)
Do While myfile.atendofstream <> True
myline = myfile.readline()
myline2 = Split(myline, " ")
newip = myline2(9)
myurl = myline2(5)
If targeturl = myurl Then
writelog newip
End If
Loop
myfile.Close
Set fileobj2 = Nothing
Msgbox "結(jié)束."
Sub writelog(errmes)
ipfilename = "blockip.txt"
Set logfile = fileobj.opentextfile(ipfilename, 8, True)
logfile.writeline errmes
logfile.Close
Set logfile = Nothing
End Sub
'代碼結(jié)束
分析出來(lái)的IP如果出現(xiàn)異常，可以通過(guò)程序，將其批量添加到IIS的屏蔽IP列表里，下面是網(wǎng)上找到的一段VBScript代碼，將其改名為vbs后，把上面那段程序的IP導(dǎo)入，即可批量屏蔽攻擊者的IP地址。
'/*=========================================================================
' * Intro VBScript使用ADSI為IIS批量添加屏蔽或允許訪問(wèn)的IP
' * FileName VBScript-ADSI-IIS-Add-Deny-Grant-IP-Change-MetaBase.xml.vbs
' *==========================================================================*/
'AddDenyIP2All "192.168.1.106,255.255.255.0"
'AddDenyIP "123456","127.0.0.1"
'AddDenyIP2All "14.113.226.116"
'添加要屏蔽的IP或一組計(jì)算機(jī)，到一個(gè)指定站點(diǎn)上
Sub AddDenyIP(strWebNo, strDenyIp)
On Error Resume Next
Set SecObj = GetObject("IIS://LocalHost/W3SVC/" & strWebNo & "/Root")
Set MyIPSec = SecObj.IPSecurity
MyIPSec.GrantByDefault = True
IPList = MyIPSec.IPDeny
i = UBound(IPList) + 1
ReDim Preserve IPList(i)
IPList(i) = strDenyIp
MyIPSec.IPDeny = IPList
SecObj.IPSecurity = MyIPSec
SecObj.Setinfo
End Sub
'添加要屏蔽的IP或一組計(jì)算機(jī)，到IIS公共配置，以應(yīng)用到所有站點(diǎn)
'如果之前對(duì)有些站點(diǎn)單獨(dú)做過(guò)屏蔽IP設(shè)置，在些設(shè)置不會(huì)生效，得在總的網(wǎng)站上設(shè)置一下，然后覆蓋所有子結(jié)點(diǎn)
Sub AddDenyIP2All(strDenyIp)
On Error Resume Next
Set SecObj = GetObject("IIS://LocalHost/W3SVC")
Set MyIPSec = SecObj.IPSecurity
MyIPSec.GrantByDefault = True
IPList = MyIPSec.IPDeny
i = UBound(IPList) + 1
ReDim Preserve IPList(i)
IPList(i) = strDenyIp
MyIPSec.IPDeny = IPList
SecObj.IPSecurity = MyIPSec
SecObj.Setinfo
End Sub
'添加允許的IP或一組計(jì)算機(jī)，到一個(gè)指定站點(diǎn)上
Sub AddGrantIP(strWebNo, strGrantIp)
On Error Resume Next
Set SecObj = GetObject("IIS://LocalHost/W3SVC/" & strWebNo & "/Root")
Set MyIPSec = SecObj.IPSecurity
MyIPSec.GrantByDefault = False
IPList = MyIPSec.IPGrant
i = UBound(IPList) + 1
ReDim Preserve IPList(i)
IPList(i) = strGrantIp
MyIPSec.IPGrant = IPList
SecObj.IPSecurity = MyIPSec
SecObj.Setinfo
End Sub
'添加允許的IP或一組計(jì)算機(jī)，到IIS公共配置，以應(yīng)用到所有站點(diǎn)
'如果之前對(duì)有些站點(diǎn)單獨(dú)做過(guò)屏蔽IP設(shè)置，在些設(shè)置不會(huì)生效，得在總的網(wǎng)站上設(shè)置一下，然后覆蓋所有子結(jié)點(diǎn)
Sub AddGrantIP2All(strGrantIp)
On Error Resume Next
Set SecObj = GetObject("IIS://LocalHost/W3SVC")
Set MyIPSec = SecObj.IPSecurity
MyIPSec.GrantByDefault = False
IPList = MyIPSec.IPGrant
i = UBound(IPList) + 1
ReDim Preserve IPList(i)
IPList(i) = strGrantIp
MyIPSec.IPGrant = IPList
SecObj.IPSecurity = MyIPSec
SecObj.Setinfo
End Sub
'顯示IIS公共配置里禁止訪問(wèn)的IP
Sub ListDenyIP()
Set SecObj = GetObject("IIS://LocalHost/W3SVC")
Set MyIPSec = SecObj.IPSecurity
IPList = MyIPSec.IPDeny 'IPGrant/IPDeny
WScript.Echo Join(IPList, vbCrLf)
' For i = 0 To UBound(IPList)
' WScript.Echo i + 1 & "-->" & IPList(i)
' Next
End Sub
