Vulnerability Scans

00:00

hello and welcome back to the course, identifying with attacks through logs.

00:05

In the last video, we talked about Web application attacks. Ah, wasp and you are all components

00:11

In this video, we'll discuss our first attack and do some vulnerability scans.

00:16

Let's start with a learning objectives

00:18

In this video. The learning objectives are to review vulnerability scans and their tools

00:23

and to identify vulnerability scans with Web Server log analysis.

00:28

First, let's remember what a vulnerability is.

00:31

As we said before, Ah, vulnerability is a weakness that could be exploited,

00:36

and there is a specific topic on vulnerabilities in the A WASP Top 10.

00:41

Do you remember? Each topic is Topic a nine

00:43

using components with no vulnerabilities.

00:46

This is more related to the components needed for the Web application toe work.

00:50

For example,

00:51

if you're using an old version of PHP, your your Web application can be vulnerable even if all the components are updated.

00:58

So if you have any vulnerabilities in your Web application,

01:02

it's better to know.

01:03

Suppose your sock analyst working in a big company.

01:07

How do you know that your Web application is vulnerable?

01:11

You can investigate the Web application code and look for vulnerabilities, but

01:15

this would take a lot of time.

01:17

Another way is using vulnerability scanners,

01:21

vulnerability scanners, air software that try to find weaknesses in your Web application.

01:26

If you launch some known attacks and check your applications responses

01:30

depending on the Web application response, it will say whether or not you have a vulnerability.

01:34

Vulnerability. Scanners are available. Toe everyone

01:38

so you can use it to protect your Web application. But attacker can also use them to find vulnerabilities, which they can exploit later.

01:47

Vulnerability scanners are also good to test your security tools like I. D. S, I. P s and the Web applications Firewall.

01:55

There are many vulnerability scanners available, some open source and some paid.

02:00

In some companies, vulnerability scans are not considered as an attack.

02:05

Sometimes it's called a pre attack.

02:07

So in this course, the vulnerability scans will be just one type of an attack.

02:13

So

02:13

the vulnerability scanners can be used to perform vulnerability scans.

02:19

Do you know any software that's considered a vulnerability scanner?

02:23

Here are some examples of vulnerability scanners. There are many others available. Some scanners, like SQL map, are specific For one type of vulnerability.

02:31

SQL map is really useful in testing your Web application against SQL injection attacks.

02:38

Some other examples are nick toe, zed Burp and APP scan.

02:44

You can find a good list on this website.

02:46

Can you think of one way of identifying them?

02:50

The easiest way to identify the vulnerability scanner is checking the user agent like in this example,

02:57

the user agent is the SQL Man.

02:59

If you see a user agent related to a vulnerability scanner in a log,

03:04

there's a good chance of vulnerability. Skin is happening against the Web server,

03:07

but what's the problem here?

03:09

Well, normally, it's not that easy.

03:12

Remember that user agents are used to detect, but they can be faked in the vulnerability. Scanners usually have the option to change the user agent, so be careful.

03:23

It's also possible for you to see different user agents like programming languages, for example,

03:29

Python requests.

03:30

Let's use Nick Toe to perform a scan on our lab.

03:35

The first two lines are examples of Nick. No requests.

03:38

We didn't change the user agent so you could identify nicked OAS. The user agent.

03:43

We had close to 8000 requests in less than one minute, so we have a big number of requests in a small period of time.

03:50

This is common behavior for different vulnerability scanners,

03:53

but if you want, you can run the scan as lower.

03:58

If we're doing a vulnerability scan, you should look for all known vulnerabilities

04:02

as we saw. This is going to generate a lot of requests, and many of these requests will return errors, especially four Oh four.

04:11

Do you agree with that statement?

04:13

Okay,

04:14

so let's try to confirm the theory

04:16

will crunch the numbers of the requests with Nick Toe user agents and after we'll count the same lines looking for 404.

04:24

The first is the number of lines that have nicked OAS the user agent, and the second is the number of lines that have nicked as the user agent and also had the 404 error.

04:34

You can see that the number isn't really different.

04:38

That happens because we do a lot of requests and most of these requests don't work.

04:43

This is a typical case in vulnerability scans, some important things to look for

04:47

the user agent, the number of requests and the number of errors.

04:54

No,

04:55

let's analyze this log

04:57

in the first line, you can see the user agent Nick toe a weird request and also a four oh four error.

05:02

The other lines are similar, but some of them don't have Nick toe as user agent. And if you look at all the requests

05:09

at the same,

05:11

this is an example of requests which crafted user agents.

05:15

In both cases, the user agent was nick Toe.

05:18

Since the Vulnerability scan has unknown behavior,

05:21

here are some directions that can help you toe identify a vulnerability scanner.

05:27

Start looking for the user agents.

05:29

Look for scanners or unknown user agents.

05:31

Check the number of the requests. Are there many requests in a small period of time? Are these requests coming from the same client I P address?

05:41

Look for the number of errors and unexpected requests, like

05:45

PHP requests in a page that doesn't have PHP.

05:48

The more you know about your application, the easier it's going to be.

05:51

Also check if the requests are two configuration pages or two administration pages,

05:58

command or operational system. Words and requests are suspicious is well, words like Ping Cat and Shell are examples of these words. Used invulnerability stands

06:10

post assessment question.

06:12

Consider this scenario,

06:14

the knock team asked you to check the behavior of one Web server because they found an increased number of the weird requests and 404 errors.

06:21

The knock team sent a print of the Web server CPU and says that it looks normal.

06:27

You check the Web server logs for more information about the Web server.

06:30

They say that it's an Apache

06:31

and this is not a WordPress deploy.

06:33

Here's a portion of the Web server locks.

06:36

The next slide will have some questions about this case.

06:40

I suggest that you pause the video and make the log analysis.

06:44

Remember to get the key information on the logs like type requests, and remember to answer the who,

06:48

when and what.

06:50

I hope that you enjoy doing this. Log analysis.

06:56

Let's analyze together. Now

06:59

we have the same client I P address that is doing a lot of requests. 10.1 point oh 10.

07:04

You also have more than one request at the same time, and many four or four errors

07:10

for the first line. Can you explain the 404?

07:13

The reason is this request looks like a WordPress request,

07:17

and this application

07:18

is not a WordPress application.

07:21

Now, based on this scenario as a sock analyst, answer this questions

07:27

which I p addresses causing the trouble.

07:31

The answer is, let her seat

07:34

all the long lines contain this I p address

07:39

to

07:40

what behavior did you identify in the law?

07:43

Did you find an attack?

07:45

The answer is, let her seat

07:46

vulnerability scan.

07:50

In the last slide, we saw some behaviors that confirmed the vulnerabilities can, such as theme, metaphor of four errors, the weird requests, the many requests in a small period of time, unexpected requests and others.

08:03

Your knock team is waiting for your analysis.

08:05

Let's compose a possible answer to the knock.

08:09

Here is a possible answer,

08:11

and in answer to the questions of who, when and what

08:13

in the real world, there are other activities that need to perform, like checking if the Web server is vulnerable or if any vulnerability was exploited,

08:22

a suggested action would be blocking this I p address because it performed an attack

08:31

video summary.

08:31

In today's video, we discussed vulnerability skin attacks. We showed some vulnerability scanner examples and how to identify this behavior.

08:39

First, check the user agents look for many requests in a small period of time. Look for many errors, especially 4 to 4.

08:46

Look for weird words and unexpected requests.

08:50

This includes our first attack example and log analysis.

08:56

For the next video,