# Introduction to Hacked Web Server Analysis

## **Effective Web Log Analysis for Incident Response**

Web services are a crucial component of modern infrastructures, making them a common target for attackers. By analyzing web server and system logs, incident responders can uncover unauthorized activities, diagnose system errors, and respond to security threats effectively. Below is a structured guide to log analysis.

***

## **Key Steps in Log Analysis**

### **1. Accessing Logs**

Common log file locations:

* **Web Server Logs**:
  * **Apache**: `/var/log/apache2/access.log`, `/var/log/apache2/error.log`
  * **Nginx**: `/var/log/nginx/access.log`, `/var/log/nginx/error.log`
* **System Logs**:
  * `/var/log/syslog`, `/var/log/messages`

### **2. Define the Analysis Objective**

Determine the focus of your log analysis. Common objectives:

* **Detecting Unauthorized Access:** Identify brute force or compromised login attempts.
* **Identifying SQL Injection or Web Exploits:** Spot injection patterns targeting the web app.
* **Diagnosing Server Issues:** Look for application errors or system performance bottlenecks.
* **Investigating Data Exfiltration:** Uncover unusual or excessive data transfers.

### **3. Filter and Extract Relevant Data**

Efficient analysis requires filtering through large volumes of logs. Use UNIX tools to focus on meaningful patterns.

***

## **Common Tools for Log Analysis**

### **1. grep**: Search for specific patterns.

```bash
grep "error" /var/log/nginx/error.log
```

### **2. awk**: Extract and format fields from logs.

```bash
awk '{print $1, $7}' /var/log/nginx/access.log
```

This command prints the IP address and the requested URL.

### **3. sed**: Perform basic text transformations.

```bash
sed -n '/404/p' /var/log/apache2/access.log
```

Filters and displays lines with HTTP 404 errors.

### **4. cut**: Extract specific sections of each line.

```bash
cut -d' ' -f1,7 /var/log/nginx/access.log
```

Extracts the IP address and URL field.

***

## **Log Analysis Scenarios**

### **1. Detecting Unauthorized Access**

Identify brute force or credential stuffing attempts by searching for repeated failed logins:

```bash
grep "Failed password" /var/log/auth.log
```

For web-based login attempts:

```bash
grep "POST /login" /var/log/apache2/access.log
```

### **2. Identifying SQL Injection Attempts**

Look for common SQL injection keywords:

```bash
grep -i "union select" /var/log/nginx/access.log
```

### **3. Spotting Web Exploits**

Find exploit attempts targeting vulnerable paths:

```bash
grep -E "(/wp-admin|/phpmyadmin)" /var/log/nginx/access.log
```

### **4. Investigating Data Exfiltration**

Identify large data transfers that might indicate data theft:

```bash
awk '{if($10 > 1000000) print $0}' /var/log/nginx/access.log
```

### **5. Diagnosing System Errors**

Review application or server errors:

```bash
grep "error" /var/log/apache2/error.log
```

***

## **Understanding Key Fields in Web Server Logs**

**Access Logs Format:**

```
192.168.1.1 - - [12/Nov/2024:12:34:56 +0000] "GET /index.html HTTP/1.1" 200 1024
```

* **IP Address**: `192.168.1.1`
* **Timestamp**: `[12/Nov/2024:12:34:56 +0000]`
* **Request Method**: `GET`
* **URL**: `/index.html`
* **Status Code**: `200` (OK)
* **Response Size**: `1024 bytes`

**Error Logs Format:**

```
[Wed Nov 12 12:34:56 2024] [error] [client 192.168.1.1] File does not exist: /var/www/html/favicon.ico
```

* **Timestamp**: `[Wed Nov 12 12:34:56 2024]`
* **Error Level**: `[error]`
* **Client IP**: `192.168.1.1`
* **Error Message**: `File does not exist`

***

## **Best Practices for Log Analysis**

### **1. Centralize Logs**

Use tools like the **ELK Stack (Elasticsearch, Logstash, Kibana)** or **Graylog** to consolidate and analyze logs efficiently across multiple systems.

### **2. Automate Log Analysis**

Create reusable **shell scripts** for repetitive tasks:

```bash
#!/bin/bash
grep "POST /login" /var/log/apache2/access.log | awk '{print $1, $7, $9}'
```

### **3. Set Up Alerts**

Configure real-time alerts for critical events such as:

* Multiple failed logins.
* High volume of HTTP 404 or 500 errors.
* Suspicious URLs or IP addresses.

**4. Retain Logs**

Implement log retention policies to ensure you have historical data for long-term investigations.

***

## **Key Points**

Web log analysis is an essential skill for incident response teams. By leveraging tools like **grep**, **awk**, and centralized logging systems, analysts can quickly identify security threats and system issues. Mastering these techniques enables faster detection, response, and mitigation of web-based attacks.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/lets-defend/incident-responder-path/hacked-web-server-analysis/introduction-to-hacked-web-server-analysis.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.