inpt is an access log file from Apache

decode_exploit_url_from_access_log.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-


import sys
import codecs
import urllib


filename = sys.argv[1].strip()

f = codecs.open(filename, "r", "utf8")
lines = f.readlines()
f.close()


for line in lines:
    line = line.strip()
    if "POST" in line and "cgi" in line:
        line = line.split("POST ")
        if len(line) > 1:
            line = line[1].split(" ")
            if len(line) > 1:
                url = line[0]
                print urllib.unquote(url)