Lire en françaisع
Menu

Back to the Academy

CLR-4 · Hands-on lab · Easy ·about 25 min

A web server under probe

A public shop looked slow one afternoon. Read its access log like a defender: spot the scanner, the forgotten file it found, and two attacks against the app, one of which worked.

Briefing

Your SOC looks after shop.novaretail.example, a public e-commerce site. This afternoon it was sluggish, and the ops team handed you the web server’s access log.

You are reading it as a defender: the attack has already happened, and your job is to understand it from the traces it left. The log is in the combined format, one request per line:

IP - - [date] "METHOD path HTTP/1.1" status size "referer" "user-agent"

What to reconstruct:

  1. Who: one client is behind almost all the noise.
  2. What leaked by accident: a scanner finds files nobody meant to publish.
  3. What was attacked on purpose: a SQL injection on the product search, and a path traversal on a download link. For each, the status code tells you whether it worked (200) or was blocked (403/500).

Remember that servers store URLs percent-encoded: %27 = ', %20 = space, %2f = /, %2C = ,. Start with cat case-0533/NOTE.txt, then count IPs with cut and sort | uniq -c. Everything is simulated: reserved domains and documentation IP ranges only.

Terminal

Type help to list the commands. Tab completes, ↑ ↓ browse the history.

Questions

  1. One IP address is responsible for almost all the errors and the probing. Which IP is it?25 XP

    1. While probing, the scanner requested many files that do not exist, but one returned 200 and a large body: a file that should never have been online. What is its exact path?25 XP

      1. The attacker then hit /products with a SQL injection. One attempt returned 200 and a big response. Which database table does that payload read from?25 XP

        1. The attacker also tried to read files off the server through the /download endpoint (path traversal, the ../ sequences). One of those requests returned 200. Which file did it manage to read?25 XP