# SPDX-License-Identifier: AGPL-3.0-only
# Walking WordPress's author archives to collect usernames:
#   /?author=1, /?author=2, ...
# WordPress redirects /?author=N to that user's posts, revealing the
# login name. It is the reconnaissance step before a password attack.
#
# Only the query string is examined, so a page whose PATH contains the
# word does not count.
parser: wp-user-enum
log: http
prefilter: "author="
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)\?(?P<query>[^ "]*[Aa]uthor=\d[^ "]*) [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx
