# Copyright 2020 FireEye, Inc. and Citrix Systems, Inc.

declare -a scanning_regexes;

# [any method] [space] [any url prefix] /vpns/ [any url postfix] .pl [space] HTTP/1.1" [200]
#                                        ^^^^ may be encoded
scanning_regexes[0]="\]\s\"[A-Z]{3,7}\s[^\s]*/(v|%76)(p|%70)(n|%6[Ee])(s|%73)/[^ ]+\.(pl|conf).*HTTP/1\.1\"\s200";

successful_scanning() {
    if [ ! -d "$root_directory/var/log/" ]; then
        debug "didn't find /var/log/";
        return;
    fi

    local results="";
    for regex in "${scanning_regexes[@]}"; do
        hits=$(find "$root_directory/var/log/" -type f -iname "*httpaccess*" -exec zgrep -HEi "$regex" {} \;);
        # ref: https://stackoverflow.com/a/3182519/87207
        results="$results"$'\n'"$hits";
    done

    local readonly deduped_results=$(echo "$results" | grep -E [a-zA-Z0-9]| sort | uniq);
    local readonly result_count=$(echo "$results" | grep -E [a-zA-Z0-9]| sort | uniq | wc -l);

    if [ $result_count -gt 0 ]; then
        report_scanning "web access logs show $result_count instances of successful HTTP scanning";
        report "web access log entries:"
        report "$deduped_results";
    else
        debug "no instances of scanning attempts found in HTTP access logs";
    fi
}

scan_successful_scanning() {
    successful_scanning;
}