Tips and Common Issues Part 2

00:00

to continue on this lesson. We'll discuss some issues and mistakes that are common during logging access.

00:06

The first mistake is not knowing your application.

00:09

It's hard to identify if a request is an attack. If you don't know at least a little bit about your Web application,

00:15

knowing the application means knowing the programming language, the technology behind the Web server software or any other information related to the Web application.

00:23

All this information will lead you to a much better analysis.

00:28

See this request?

00:30

This is on Lee the requested file for a line of log.

00:33

It looks normal, right?

00:36

A get request to this PHP page. But

00:39

what if our server doesn't run PHP?

00:41

Why would someone be requesting this page? What a typical user access this page

00:47

analyzing now the full log of this request. You can see that the several responses 400 or not found.

00:53

This is expected behavior, since the application doesn't have PHP.

00:57

If you look for more information about this request, it'll show that this is a common request for WordPress deployment,

01:03

and there are some vulnerabilities related to this Web page.

01:07

As expected, this application does not run WordPress

01:11

if you were a knock analyst, everything would look fine,

01:15

But for a sock analyst, this log is suspicious.

01:19

Since you know the application, you know, PHP is not on this Web server. So you could say that this request is malicious

01:26

but that there is no risk to it.

01:27

The classifications of this event depends on the company policies.

01:33

It could be classified as a false positive for a vulnerability scan.

01:38

Sometimes it will happen that we will not have enough time to analyze the locks.

01:42

Maybe your boss wants a fast answer. And maybe you forget to check all the logs.

01:49

More logs equals more information.

01:53

One of the important points is to confirm that you have enough information to analyze your logs. Remember to ask for all the logs. Ask for the era. Log to

02:01

another example Is that

02:04

maybe you just have a small period of logs available or if you're the Web server administrator, maybe you received the wrong logs. Maybe someone modified the logs.

02:13

One example that happened before was I asked the Web server administrator for the logs inside the default log folder.

02:20

I only received a small amount of logs, though

02:23

afterwards I spoke with the server administrator, and he told me that in the company they changed the Log Start folder.

02:29

Then I requested the logs from the correct folder and received the correct amount of logs.

02:36

Some important questions.

02:38

Do I have all the logs? Is it a busy server? A busy Web server will have more logs.

02:44

Could it be possible that someone changed the logs?

02:46

Sending the log to remote sis log server can reduce this risk.

02:51

Always check if the logs are the correct ones, like in the example of the different start folder.

02:57

Another thing that can happen is that the Web server has more than one website and each website can have its own logs.

03:02

So you need to ask for the correct website locks.

03:08

Here's a little example.

03:10

Suppose you receive a log portion to analyze

03:14

during your analysis. You see these two logs.

03:16

Can you identify something wrong with these logs?

03:21

Let's analyze.

03:22

We have two different client I P addresses.

03:25

Both Web server answers are 200.

03:29

The first log line

03:30

already looks suspicious.

03:31

The first line method is head and the second one is he get

03:35

you have the date in time So

03:37

what's wrong?

03:38

Well, if you take a better look at the date and time, you'll find something is weird.

03:43

The time between the two lines is more than one hour.

03:46

If it's a busy surfer, it's a little hard to believe that the Web server didn't receive a request for more than one hour.

03:53

There are many reasons this might have happened. A server admin error. This just isn't a busy server. Someone deleted the logs. The logs were moved to another file, and so on.

04:05

Another important thing to remember regarding the date and time is to check the times. Um,

04:11

it's better when the auto Web server logs at the same time, so

04:15

but this is not always true.

04:16

You always need to confirm that the logs you have are enough and that they are the correct ones.

04:21

But it is also possible that you might not have any logs to analyze. Or maybe you have the logs, but the logs are incomplete or the log configurations are incorrect.

04:35

As another example, check this law.

04:39

Can you tell why it's incomplete

04:41

in this log? You have the time, but you don't have to date

04:45

this. I P address cannot be from our client because it's a local host i p address, although it can be the Web server I p address

04:51

since we have the time in the beginning of the line and the Web server IP address.

04:57

This log looks like a nice slog, but

04:59

we don't have the client I p address the user agent or the refer.

05:03

Even if the log looks good, incomplete logs would make the investigation really hard and inconclusive.

05:09

If you get a log like this, go to the Web server administrator and asked them to configure it. Better

05:15

to summarize,

05:16

we only have two of the seven fields that we'd like to see.

05:20

This is different from the hyphen. When we have the hyphen, we have the field, but we don't have to value

05:27

here. Even the hyphen is missing, so we don't even have the field.

05:30

It's really missing.

05:33

Another problem that can happen is simply extracting the wrong information.

05:39

If you understand the log, you won't. You won't extract incorrect information.

05:44

For example, in the first log line here, you have to I p addresses. One is from the client and one is from the Web server

05:50

Maybe this log is from Microsoft, I s. But it could also be from a different party. Or it could be from N g i N X law configuration.

06:00

The second line is from Apache again this books like Apache Order N G I N X.

06:05

If we extract more information from this log,

06:09

the conclusion of our analysis could be wrong.

06:12

If you have any doubts about the Web server logs, talk with your Web server administrator.

06:17

And finally, we'll talk about something that's not on Lee related to the Web. Server locks,

06:24

not documenting all your findings, is not only related to the Web server log analysis, but also to handling security incidents.

06:31

You can use whatever you prefer, whether that may be a text editor, mind maps, notebooks or whatever.

06:38

I like notebooks for two reasons. First, when you write something, it's easier to memorize.

06:43

Second, you know all the information is in one place.

06:46

Most of the time I start using a notebook, which helps later in a text editor.

06:50

It's up to you to see which one works better for you.

06:54

Creator. Create your document

06:56

so you can use it to most efficiently answer most of the questions and at least say who,

07:01

what and when.

07:04

Post assessment questions.

07:06

Is this information true or false? Onley Web browsers Consent http Request to the Web servers

07:14

This information is false.

07:16

As we talked about in this video. There's a lot of software they can craft. Http requests like Curl tell Net w Get and programming languages

07:27

for the next question to note whether the log field could be crafted or not.

07:30

Take your time to answer and positive video if you'd like.

07:38

Here is the answer.

07:40

Remember,

07:41

all the log feels related to the clients can be manipulated in the fields generated by the Web. Server cannot be manipulated by the client.

07:48

For example, the date and time is based in the Web servers operational system. Time

07:55

for the last question.

07:57

Consider the logs below.

07:59

Can you tell which fields are missing?

08:01

You can pause a video if you want.

08:05

In the first logline. We don't have the I P address, so it's missing the client I P address

08:09

in the second line. We don't have the date and time information.

08:13

Can you find what's missing in the last line?

08:18

The last line is tricky, but If you take a closer look at the requested file, you'll see we Onley have the method and the http version

08:24

the requested file is missing.

08:26

The minimum requested file is the slash

08:31

video summary.

08:33

In this video, we started talking about the differences between knock and sock analysis

08:39

after we discussed fake requests and crafted http requests.

08:43

At the end, we gave some examples of issues and common mistakes that can occur during the log analysis

08:48

module one is now finished.

08:50

We will start module to with a brief review covering the attacks that target Web applications