#!/usr/local/bin/perl -- -*-fundamental-*-

##  Spampath.pl
##  Written by Greg Mullane <greg@turnstep.com>
##  Please see http://www.turnstep.com/Spambot/
## 
##  This program searches an access log for entries that 
##  have followed a specific path
##  Use at your own risk

##  Usage: spampath.pl access_log path.txt
##  Default access log filename is "access_log"
##  Default path file is "path.txt"
##  Path.txt should have the path as one url per line

##  Notes: This program assumes the following:
##  1. You have enough memory to run this. Access logs get BIG
##  2. The access log is in a "standard" format

$accessfile = $ARGV[0] || "access_log";
$pathfile   = $ARGV[1] || "path.txt";

open(KILLSPAM, $pathfile) || die "Could not find $pathfile!\n";
$pathtotal=0;
while(<KILLSPAM>) {
  unless (/^#/) {
    chop; push(@path,$_);
    $pathtotal++;
  }
}
close(KILLSPAM);

open(KILLSPAM, $accessfile) || die "Could not find $accessfile!\n";

$lines=0; ## Total lines
$unip=0;  ## Unique IP's
while(<KILLSPAM>) {
  $lines++;
  if (m#(.*) - - \[.*\"GET ([^ ]*)#) {
    $ip = $1; $path = $2;
    if ($path eq $path[$path{$ip}]) {
      if ($path{$ip}+1 == $pathtotal) {
        print "$ip\n";
        $x++ > 10 && exit;
      }
      $path{$ip}++;
    }
  }
}
close(KILLSPAM);
exit;