---
description: Network Forensics lab let`s go on
---

# Web Investigation Blue Team Lab

## 1- Detect The attacker Ip&#x20;

After Launch the Pcap File in Wireshark and go to Statictics and Conversation tab there was two exteranl Ip connected to our Host and when look to the Packet Size we can easily detect that this Packet Connection size is not normal&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FCdga6iAMwhyIl6obcB5V%2FScreenshot%202024-08-15%20172629.png?alt=media&#x26;token=8153a0ad-43be-4ffe-87c5-c603eec970a2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FUSGCCa69Palw2ENtOdug%2FScreenshot%202024-08-15%20172652.png?alt=media&#x26;token=74336710-1bf2-4c51-8aab-5518317ea477" alt=""><figcaption></figcaption></figure>

## 2- To detect The city of the attacker i used [https://www.iplocation.net/ip-lookup](https://www.iplocation.net/ip-lookup)

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FncOr2YphAOc6hFHImBNS%2Fimage.png?alt=media&#x26;token=89182eaa-cb16-4d3a-aaa5-bb4a8321ea73" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FyXhxiHAzI8p2dyyuaSCl%2Fimage.png?alt=media&#x26;token=0786408b-5634-40d0-ad86-6469145ca20c" alt=""><figcaption></figcaption></figure>



## 3-To identify the script i go to Statistics tab and HTTP Requests to find this awesome script that used Sql.map to Test Sql injection and this easily detectable by the payloads that shown&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F9xmv0zfpl5lzrcYbApfC%2FScreenshot%202024-08-15%20175353.png?alt=media&#x26;token=9c2d00c5-b7a2-4380-aadd-bb99e1ea37ae" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FEZYEmyEK6dPxMghSlSqk%2FScreenshot%202024-08-15%20175440.png?alt=media&#x26;token=3cbc63e7-e940-4612-afb0-f463ff5dd80a" alt=""><figcaption></figcaption></figure>

So the script is _<mark style="color:red;">**`{search.php}`**</mark>_

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FH67bIrZN3Fe9uyH4opDN%2Fimage.png?alt=media&#x26;token=fcb69092-3b03-4c45-b227-1907424e20f3" alt=""><figcaption></figcaption></figure>

## 4- To FInd the first Successful Request i used filter and add on the the attacker ip and the destination Ip and in the find option add Sql payload in string I used <mark style="color:blue;">`1=1`</mark>



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FlD7ncw4skrlMDes2hAy1%2FScreenshot%202024-08-15%20180414.png?alt=media&#x26;token=ae105386-72fb-47b1-bf6e-80d6e1de1337" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FT8eiYGPFKo6x3pS87fcw%2FScreenshot%202024-08-15%20180419.png?alt=media&#x26;token=c5c2cc22-39fe-4830-bc38-9f08ac02312d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FzaTrWPmscPjNtX4cCbJi%2FScreenshot%202024-08-15%20180431.png?alt=media&#x26;token=3991c94e-7c15-495f-85cf-c77ceb715413" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FxJ9i4exq0e56jOM61cqk%2Fimage.png?alt=media&#x26;token=22759f14-7585-424d-bcc0-5dbd53f0681c" alt=""><figcaption></figcaption></figure>

## 5-To find The Full request URL i add filter status code =200 wich is successfull and in find use mysql That it is the most common library and got it and follow the HTTP request to detect the full request&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FzlGeqdQr6CrMvki3vtAc%2FScreenshot%202024-08-15%20185436.png?alt=media&#x26;token=d5007e63-3647-469a-9c04-7080e355b646" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FmMIpMuaf6Ex6YXdHmAiE%2FScreenshot%202024-08-15%20185441.png?alt=media&#x26;token=00a1d1e6-c631-4339-8395-1952175f38e7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FTKkqSX9IUUliNWj0Xt6r%2FScreenshot%202024-08-15%20185454.png?alt=media&#x26;token=6e706716-12f4-48b3-9b23-629cf42e1f2a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F5tcVYSlZbzPNYJYWTUG8%2FScreenshot%202024-08-15%20185822.png?alt=media&#x26;token=7fd16490-3c9d-4e2a-bf25-aa25c84f951e" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F1V7WxgADeED3vHIIHn4T%2FScreenshot%202024-08-15%20190336.png?alt=media&#x26;token=bf7ba9ff-f97a-47a2-a5a2-02c75f52eeb7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fxw2vxyIqM2qdccrccxDp%2Fimage.png?alt=media&#x26;token=b9e4484b-4ad1-403c-9adc-f3435d6cc1f9" alt=""><figcaption></figcaption></figure>

## 6-To determine the table i used Network Miner and search with the script name and search for the biggest packet size and take the destination port and follow the http request and simply it is _<mark style="color:purple;">`customer`</mark>_ table

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fa2zkLHiPVPuQeYxxqrXO%2FScreenshot%202024-08-15%20190955.png?alt=media&#x26;token=9fa586e8-4bb7-4e27-9f7f-698f437708ce" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F92nwHy4RzRvZOuNoEOMg%2FScreenshot%202024-08-15%20200955.png?alt=media&#x26;token=be26ac04-3981-4054-bf7f-ed5efaefeea0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fac2HAYWk0vcVYwBxN1e9%2FScreenshot%202024-08-15%20201043.png?alt=media&#x26;token=ccb9c209-0aae-4c51-a075-24607c73928b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FJeJ2sc34Ibf7gSiaVLwr%2Fimage.png?alt=media&#x26;token=a536b7a4-4757-41d3-9631-5a7a30ee81c1" alt=""><figcaption></figcaption></figure>



## 7- To determine the hidden directories and after searching it light up on my head to search for the admin panel the attacker usually try to login with the admin user by the way and usually follow the http request&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FnaA068fXMNRnIo2uheAo%2FScreenshot%202024-08-15%20201429.png?alt=media&#x26;token=9318a0dc-d9f0-438e-8530-bb2e5d2a201d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FWp7Alpc4HmNpk5JUpLvL%2FScreenshot%202024-08-15%20201914.png?alt=media&#x26;token=f4ac95a8-0429-4afe-a1aa-e63c61ecffab" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F9mj9YQyb2k9zqGCbZ4JK%2Fimage.png?alt=media&#x26;token=718781a7-724d-47da-9641-d02822331eff" alt=""><figcaption></figcaption></figure>

## 8-To determine the credentials i add filter to pull the post request and also  follow the http request the first follow is invalid so increase the stream and get the username and password and decode it&#x20;

<div><figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fw0X2mJ2XHWKKb0hch5WM%2FScreenshot%202024-08-15%20202921.png?alt=media&#x26;token=b3fc9643-948b-4ebe-9a60-bb6501284206" alt=""><figcaption></figcaption></figure> <figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FtzbBGlFJZ9hSJcTid3jr%2FScreenshot%202024-08-15%20202819.png?alt=media&#x26;token=5f2d5c1b-690a-45b3-a132-06da1113a95a" alt=""><figcaption></figcaption></figure> <figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F6x5HeVII7s1KZUiQ34L0%2FScreenshot%202024-08-15%20202524.png?alt=media&#x26;token=037d4a66-7629-41db-9d95-13c9537a55aa" alt=""><figcaption></figcaption></figure> <figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FHlCEKYyJhdxckn6zj7S2%2FScreenshot%202024-08-15%20201914.png?alt=media&#x26;token=25d4a59f-fe4e-415c-a4bf-dde9d55797c6" alt=""><figcaption></figcaption></figure></div>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FoL1KxmnuTSjL2hw4mDbE%2Fimage.png?alt=media&#x26;token=7e1d0a27-905e-47c9-a61c-3f2e90e8ebe4" alt=""><figcaption></figcaption></figure>



## 9-To get the File name i used the same tcp filter and increase the stream to finally determine it&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F3Zs6ojy50YPGYsxmSTQ3%2FScreenshot%202024-08-15%20203056.png?alt=media&#x26;token=2cd0336a-a439-4a1f-be1d-1e997f691c53" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FchRoiaXt0HR0OTePYpLt%2FScreenshot%202024-08-15%20203935.png?alt=media&#x26;token=56886179-b2a6-4db4-94a0-eec37eb88837" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F6dH7P0XyWr68q46jYzpr%2Fimage.png?alt=media&#x26;token=7d98edef-cdc5-4523-8eae-1e46155d6633" alt=""><figcaption></figcaption></figure>

