Web Investigation Blue Team Lab

Network Forensics lab let`s go on

1- Detect The attacker Ip

After Launch the Pcap File in Wireshark and go to Statictics and Conversation tab there was two exteranl Ip connected to our Host and when look to the Packet Size we can easily detect that this Packet Connection size is not normal

2- To detect The city of the attacker i used https://www.iplocation.net/ip-lookup

3-To identify the script i go to Statistics tab and HTTP Requests to find this awesome script that used Sql.map to Test Sql injection and this easily detectable by the payloads that shown

So the script is {search.php}

4- To FInd the first Successful Request i used filter and add on the the attacker ip and the destination Ip and in the find option add Sql payload in string I used 1=1

5-To find The Full request URL i add filter status code =200 wich is successfull and in find use mysql That it is the most common library and got it and follow the HTTP request to detect the full request

6-To determine the table i used Network Miner and search with the script name and search for the biggest packet size and take the destination port and follow the http request and simply it is customer table

7- To determine the hidden directories and after searching it light up on my head to search for the admin panel the attacker usually try to login with the admin user by the way and usually follow the http request

8-To determine the credentials i add filter to pull the post request and also follow the http request the first follow is invalid so increase the stream and get the username and password and decode it

9-To get the File name i used the same tcp filter and increase the stream to finally determine it