> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/lets-defend/incident-responder-path/hacked-web-server-analysis/introduction-to-hacked-web-server-analysis.md).

# Introduction to Hacked Web Server Analysis

## **Effective Web Log Analysis for Incident Response**

Web services are a crucial component of modern infrastructures, making them a common target for attackers. By analyzing web server and system logs, incident responders can uncover unauthorized activities, diagnose system errors, and respond to security threats effectively. Below is a structured guide to log analysis.

***

## **Key Steps in Log Analysis**

### **1. Accessing Logs**

Common log file locations:

* **Web Server Logs**:
  * **Apache**: `/var/log/apache2/access.log`, `/var/log/apache2/error.log`
  * **Nginx**: `/var/log/nginx/access.log`, `/var/log/nginx/error.log`
* **System Logs**:
  * `/var/log/syslog`, `/var/log/messages`

### **2. Define the Analysis Objective**

Determine the focus of your log analysis. Common objectives:

* **Detecting Unauthorized Access:** Identify brute force or compromised login attempts.
* **Identifying SQL Injection or Web Exploits:** Spot injection patterns targeting the web app.
* **Diagnosing Server Issues:** Look for application errors or system performance bottlenecks.
* **Investigating Data Exfiltration:** Uncover unusual or excessive data transfers.

### **3. Filter and Extract Relevant Data**

Efficient analysis requires filtering through large volumes of logs. Use UNIX tools to focus on meaningful patterns.

***

## **Common Tools for Log Analysis**

### **1. grep**: Search for specific patterns.

```bash
grep "error" /var/log/nginx/error.log
```

### **2. awk**: Extract and format fields from logs.

```bash
awk '{print $1, $7}' /var/log/nginx/access.log
```

This command prints the IP address and the requested URL.

### **3. sed**: Perform basic text transformations.

```bash
sed -n '/404/p' /var/log/apache2/access.log
```

Filters and displays lines with HTTP 404 errors.

### **4. cut**: Extract specific sections of each line.

```bash
cut -d' ' -f1,7 /var/log/nginx/access.log
```

Extracts the IP address and URL field.

***

## **Log Analysis Scenarios**

### **1. Detecting Unauthorized Access**

Identify brute force or credential stuffing attempts by searching for repeated failed logins:

```bash
grep "Failed password" /var/log/auth.log
```

For web-based login attempts:

```bash
grep "POST /login" /var/log/apache2/access.log
```

### **2. Identifying SQL Injection Attempts**

Look for common SQL injection keywords:

```bash
grep -i "union select" /var/log/nginx/access.log
```

### **3. Spotting Web Exploits**

Find exploit attempts targeting vulnerable paths:

```bash
grep -E "(/wp-admin|/phpmyadmin)" /var/log/nginx/access.log
```

### **4. Investigating Data Exfiltration**

Identify large data transfers that might indicate data theft:

```bash
awk '{if($10 > 1000000) print $0}' /var/log/nginx/access.log
```

### **5. Diagnosing System Errors**

Review application or server errors:

```bash
grep "error" /var/log/apache2/error.log
```

***

## **Understanding Key Fields in Web Server Logs**

**Access Logs Format:**

```
192.168.1.1 - - [12/Nov/2024:12:34:56 +0000] "GET /index.html HTTP/1.1" 200 1024
```

* **IP Address**: `192.168.1.1`
* **Timestamp**: `[12/Nov/2024:12:34:56 +0000]`
* **Request Method**: `GET`
* **URL**: `/index.html`
* **Status Code**: `200` (OK)
* **Response Size**: `1024 bytes`

**Error Logs Format:**

```
[Wed Nov 12 12:34:56 2024] [error] [client 192.168.1.1] File does not exist: /var/www/html/favicon.ico
```

* **Timestamp**: `[Wed Nov 12 12:34:56 2024]`
* **Error Level**: `[error]`
* **Client IP**: `192.168.1.1`
* **Error Message**: `File does not exist`

***

## **Best Practices for Log Analysis**

### **1. Centralize Logs**

Use tools like the **ELK Stack (Elasticsearch, Logstash, Kibana)** or **Graylog** to consolidate and analyze logs efficiently across multiple systems.

### **2. Automate Log Analysis**

Create reusable **shell scripts** for repetitive tasks:

```bash
#!/bin/bash
grep "POST /login" /var/log/apache2/access.log | awk '{print $1, $7, $9}'
```

### **3. Set Up Alerts**

Configure real-time alerts for critical events such as:

* Multiple failed logins.
* High volume of HTTP 404 or 500 errors.
* Suspicious URLs or IP addresses.

**4. Retain Logs**

Implement log retention policies to ensure you have historical data for long-term investigations.

***

## **Key Points**

Web log analysis is an essential skill for incident response teams. By leveraging tools like **grep**, **awk**, and centralized logging systems, analysts can quickly identify security threats and system issues. Mastering these techniques enables faster detection, response, and mitigation of web-based attacks.