"Offensive firewall"

[SetEnv]

Yup,

First of all: sorry for my poor english ;-)

I'm trying to write a project called 'offensive firewall'.

This project consist in two parts:

1°) A Firewall Log Analyzer, who can extract external Ip's from firewall log:

This tool will read lines present in your log file, extract IP's to buil a list and then send them to a server. -The 'talk' client/server is crypted-

If the server's analyze reveal than Ip containend in your log file where found in several other's users log file, then the FLA (when he will receive orders from server) will launch an attack agains those IP.

-Note- Your client will participate at those attacks ONLY if defined in the config file.

2°) A server who can receive datas from the FLA...

It will analyze sended IP's, and compare them with IP sended by others users.

In case of more than 10 users sended the same IP, a mail (once per day) will be sent to the 'abuse adress email' of this IP, asking to stop thoses unwanted activities.

In case of 20 users sended this IP, an attack will be launched against this IP... (like ping flood, or something else...)

I began writting the codes (not yet completelly finished).

I think the two parts are working correctly (I just tryied them on my local lan).

So, I need (if possible) coments about this project, and/or coments about the codes...

Thanks by advance,

---

The zip contains:

- LogChecker.au3 : The Firewall Log Analyzer's source code,

- Config.cfg : A config file for the FLA,

- Servers.lst : List of available server,

- LogCheck_server.au3: The server's source code,

- users : File containig users encryption key,

- Firewall.log : An example of firewall log

-- If you want to test this tool, you'll need to run the server and the FLA on the same machine, because no 'real server' are available (for now) on the internet. --

----

Autoit___LogChecker.zip