dontabuseme/script.sh at main · medmac01/dontabuseme · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
#!/bin/bash

if [ $1 = "-h" ]
then
    clear
    more README.md;
    exit
fi

if [ $1 = "-p" ]
then
    if [ $2 = "" ]
    then
        echo "You need to specify an IP Address , -h for help";
    else
        apiKey="$( cat config )"
        content=$(curl -G https://api.abuseipdb.com/api/v2/check \--data-urlencode "ipAddress=$2" \-d maxAgeInDays=90 \-d verbose \-H "Key: ${apiKey}" \-H "Accept: application/json")
        abuseScore=$( jq --compact-output '.data.abuseConfidenceScore' <<< "${content}");
        if [ "$abuseScore" -gt 25 ]
        then
            echo "> Your IP : $2 is suspecious"
            exit
        else
            echo "> Your IP : $2 is safe"
            exit
        fi
    fi
fi
clear
echo "";
echo "";

echo "   ██████╗  ██████╗ ███╗   ██╗████████╗ █████╗ ██████╗ ██╗   ██╗███████╗███████╗███╗   ███╗███████╗";
sleep .5;
echo "   ██╔══██╗██╔═══██╗████╗  ██║╚══██╔══╝██╔══██╗██╔══██╗██║   ██║██╔════╝██╔════╝████╗ ████║██╔════╝";
sleep .5;
echo "   ██║  ██║██║   ██║██╔██╗ ██║   ██║   ███████║██████╔╝██║   ██║███████╗█████╗  ██╔████╔██║█████╗  ";
echo "   ██║  ██║██║   ██║██║╚██╗██║   ██║   ██╔══██║██╔══██╗██║   ██║╚════██║██╔══╝  ██║╚██╔╝██║██╔══╝  ";
sleep .5;
echo "   ██████╔╝╚██████╔╝██║ ╚████║   ██║   ██║  ██║██████╔╝╚██████╔╝███████║███████╗██║ ╚═╝ ██║███████╗";
echo "   ╚═════╝  ╚═════╝ ╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═════╝  ╚═════╝ ╚══════╝╚══════╝╚═╝     ╚═╝╚══════╝";
sleep .5;
echo "                                                                                                ";
echo "                                              By: Mohammed Machrouh && Mohammed Elias Lakhmiri                     ";
sleep .5;
echo "                                              UEMF - EIDIA 2021";
echo "                                              github.com/medmac01/dontabuseme ";
sleep .5;
echo "                                              Pr.Hicham Moad Safhi && Pr.Khawla Tadist ";

echo "1. Check a log file for suspecious attacks";
echo "2. About Us";
echo "3. Exit";

read -p "Choose from the menu above :"

if [ ${REPLY} -eq 3 ]
then
    echo "Goodbye!";
    exit
elif [ ${REPLY} -eq 1 ]
then
    RED="\e[31m"
    ENDCOLOR="\e[0m"
    clear
    read -p "Path for log file :"
    cat ${REPLY} | cut -d ' ' -f 1 | tee out.txt
    clear
    apiKey="$( cat config )"
    testedIPCount=0
    blacklistedIPCount=0
    echo "" | tee blacklisted.txt
    file="out.txt"
    while IFS= read line
    do
        # display $line or do something with $line
        content=$(curl -G https://api.abuseipdb.com/api/v2/check \--data-urlencode "ipAddress=${line}" \-d maxAgeInDays=90 \-d verbose \-H "Key: ${apiKey}" \-H "Accept: application/json")
        abuseScore=$( jq --compact-output '.data.abuseConfidenceScore' <<< "${content}");
        if [ "$abuseScore" -gt 25 ]
        then
            echo "> Suspecious IP detected :"
            echo -e "${line}" | tee -a blacklisted.txt;
            blacklistedIPCount=$((blacklistedIPCount+1));
        fi
        testedIPCount=$((testedIPCount+1));
    done <"$file"
    clear
    percentage=$((blacklistedIPCount*100/testedIPCount))
    echo "" | tee report.txt;
    echo "Scan Date : $(date)" | tee -a report.txt
    echo ""
    echo "Scanning finished, found ${blacklistedIPCount} Suspecious IPs out of ${testedIPCount}. $percentage%" | tee -a report.txt
    echo "Do you want to block traffic from them ? [(Y)es/(N)o]"
    read rep

    if [ $rep = "" ] || [ $rep = "Y" ] || [ $rep = "y" ]
    then
        f="blacklisted.txt"
        while IFS= read l
        do
	        sudo iptables -A INPUT -s "${l}" -j DROP
	        echo ">IP Address $l Blacklisted!" | tee -a report.txt;
        done <"$f"

    fi

    echo "Do you want to send a report to your mail ? [(Y)es/(N)o]"
    read rep

    if [ $rep = "" ] || [ $rep = "Y" ] || [ $rep = "y" ]
    then
        echo " " | tee -a report.txt
        echo "Sincerely" | tee -a report.txt
        echo "DontAbuseMe Team" | tee -a report.txt
        clear
        echo "Type your mail address: "
        read mailaddress

        cat report.txt | sendmail $mailaddress -F "DontAbuseMe"
        echo "Report generated in report.txt and mail sent to : $mailaddress";
    else
        echo "Report generated in report.txt";
    fi


fi