Web Log Attack: Hunt the Webshell

The web server at this host behaved oddly after a scan. Its Apache access log (/var/log/apache2/access.log) recorded every request — including the attacker's. Somewhere in there is the story: reconnaissance (a burst of 404s and a scanner user-agent), then an upload, then repeated 200s on a script under /uploads that the site never shipped — a webshell being driven. Reconstruct it: identify the attacker and the webshell they planted. Record just the attacker's IP in /root/case/attacker_ip.txt and just the webshell's request path (e.g. /uploads/<name>.php, no query string) in /root/case/webshell.txt — one value per file (a single log line that pinpoints it is accepted too); a dump of the log, or a list that also names other clients or scripts, is not an answer.