> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/lets-defend/incident-responder-path/hacked-web-server-analysis/log-analysis-on-web-servers.md).

# Log Analysis on Web Servers

## **Log Analysis on Web Servers for Incident Response**

Log analysis is critical for identifying malicious activities such as **SQL Injection**, **Directory Traversal**, and other web-based attacks. By focusing on access and error logs, incident responders can detect and mitigate these threats effectively.

***

## **Key Log Files and Their Locations**

| **Web Server** | **Log Type**     | **Log Location**                       |
| -------------- | ---------------- | -------------------------------------- |
| Apache         | Access Logs      | `/var/log/apache2/access.log`          |
|                | Error Logs       | `/var/log/apache2/error.log`           |
| Nginx          | Access Logs      | `/var/log/nginx/access.log`            |
|                | Error Logs       | `/var/log/nginx/error.log`             |
| IIS            | Access Logs      | `C:\inetpub\logs\LogFiles\W3SVC1\`     |
| System Logs    | General Activity | `/var/log/syslog`, `/var/log/messages` |

***

## **Case 1: SQL Injection Analysis (Apache)**

**SQL Injection** exploits occur when an attacker inserts malicious SQL queries into input fields, aiming to manipulate the database.

**Steps to Analyze SQL Injection Logs**

1. **View Access Logs**:

   ```bash
   cat /var/log/apache2/access.log
   ```
2. **Search for Common SQL Injection Payloads**: Filter requests containing SQL keywords:

   ```bash
   cat access.log | grep -E "%27|--|union|select|from|or|@|version|char|varchar|exec"
   ```
3. **Filter by HTTP 200 Response**: Focus on successful injection attempts:

   ```bash
   cat access.log | grep "200"
   ```
4. **URL Decode Suspicious Entries**: Decode encoded URLs to reveal clear SQL queries:

   ```bash
   echo "/cat.php?id=1%20UNION%20SELECT%20..." | python3 -c "import urllib.parse; print(urllib.parse.unquote(input()))"
   ```
5. **Check Admin Panel Access**: After exploitation, verify if the attacker accessed sensitive areas:

   ```bash
   cat access.log | grep 192.168.2.232 | grep admin/index.php
   ```

**Example Decoded URL:**

```plaintext
/cat.php?id=1 UNION SELECT 1,concat(login,':',password),3,4 FROM users;
```

This indicates user credentials extraction.

***

## **Case 2: Directory Traversal Attack (Nginx)**

**Directory Traversal** involves navigating outside the web root directory by exploiting file paths like `../`.

**Steps to Detect Directory Traversal**

1. **Filter for Directory Traversal Attempts**:

   ```bash
   cat /var/log/nginx/access.log | grep "../"
   ```
2. **Check for Sensitive File Access**: Look for attempts to access files like `/etc/passwd`:

   ```bash
   cat access.log | grep "/etc/passwd"
   ```
3. **Inspect Successful Attempts**: Focus on HTTP 200 responses for sensitive files:

   ```bash
   cat access.log | grep "200"
   ```

**Observation:**

If you notice `/etc/passwd` being downloaded:

```bash
wget http://example.com/../../../../../etc/passwd
```

This indicates a successful traversal exploit.

***

## **Case 3: Log Analysis on IIS Web Servers**

IIS logs provide rich details about HTTP requests, including timestamps, client IPs, and request details.

**Sample Log Entry:**

```plaintext
2024-11-12 12:34:56 192.168.1.1 GET /index.html 200
```

| **Field**         | **Description**                  |
| ----------------- | -------------------------------- |
| **Timestamp**     | Event time                       |
| **Client IP**     | IP address of the request origin |
| **HTTP Method**   | Type of request (GET, POST)      |
| **URL Requested** | Resource path                    |
| **HTTP Status**   | Server response (200, 404, 500)  |

**Steps to Detect Suspicious Activities:**

1. **Search for SQL Injection**:

   ```bash
   findstr /C:"union select" C:\inetpub\logs\LogFiles\W3SVC1\*
   ```
2. **Detect Directory Traversal**:

   ```bash
   findstr /C:"../" C:\inetpub\logs\LogFiles\W3SVC1\*
   ```

***

## **Additional Tools for Enhanced Analysis**

1. **Wireshark**:
   * Inspect network traffic and POST request payloads.
2. **mod\_security or mod\_forensic**:
   * Enhance Apache logging by capturing detailed request and response data.
3. **Splunk / ELK Stack**:
   * Centralize logs for real-time correlation and visualization.

***

## **Key Log Fields for Analysis**

**Access Logs:**

Example:

```plaintext
192.168.1.1 - - [12/Nov/2024:12:34:56 +0000] "GET /index.html HTTP/1.1" 200 1024
```

* **IP Address**: `192.168.1.1`
* **Timestamp**: `[12/Nov/2024:12:34:56 +0000]`
* **Request Method**: `GET`
* **URL**: `/index.html`
* **Status Code**: `200` (Success)
* **Response Size**: `1024 bytes`

**Error Logs:**

Example:

```plaintext
[Wed Nov 12 12:34:56 2024] [error] [client 192.168.1.1] File does not exist: /var/www/html/favicon.ico
```

* **Error Level**: `[error]`
* **Client IP**: `192.168.1.1`
* **Message**: File not found error.

***

## **Best Practices for Log Analysis**

1. **Centralize Logs**: Use tools like the **ELK Stack (Elasticsearch, Logstash, Kibana)** or **Graylog** to correlate and visualize log data across multiple systems.
2. **Automate Routine Checks**: Create reusable shell scripts for recurring analysis tasks:

   ```bash
   # Example: Monitor for failed logins
   grep "Failed password" /var/log/auth.log | awk '{print $1, $2, $3, $11}'
   ```
3. **Set Alerts for Critical Events**:
   * Repeated failed login attempts.
   * High-frequency 404/500 errors.
   * Unauthorized access patterns.
4. **Log Retention Policies**: Ensure logs are stored securely and retained for an adequate period to support long-term investigations.

***

#### **Key Points**

Web log analysis is a cornerstone of effective incident response. By focusing on patterns related to SQL Injection, Directory Traversal, and other web exploits, analysts can quickly detect malicious activities and take appropriate action. Mastering these techniques and leveraging automation ensures a proactive defense against evolving threats.