Web Attack Investigation

Digital Forensics Essentials Module 2: Investigating Web Attacks

Overview of Web Attack Investigation

  • Focus on investigating web application forensics and understanding the various web attack strategies.

  • Key components include:

    • Analyzing logs from Apache and Windows-based web servers.

    • Examining security breaches in web applications.

Understanding Web Application Forensics

  • Definition: Web application forensics involves investigating and analyzing the security incidents concerning web applications.

  • Key objectives:

    • Trace the origin of the attack.

    • Analyze how the attack occurred.

  • Data collection methods:

    • Analysis of logs, configurations, and system event data.

    • Information to gather includes:

    • Dates and times of events

    • IP addresses

    • Ports and protocols used in the attack.

Challenges in Web Application Forensics

  • Web applications are distributed, posing challenges in tracing activities across various systems globally.

  • Limited down-time for investigation; applications like Amazon cannot be taken offline during forensic analysis.

  • Need for thorough analysis and correlation of large volumes of log data accurate

  • Necessity to understand different web server configurations and underlying database architectures to glean meaningful insights from logs.

Indicators of a Web Attack

  • Signs to look out for:

    • Unusual login activity (e.g., a single account logging in multiple times in a day).

    • Data leakage evidenced by data being sold on the dark web.

    • User redirection issues (e.g., legitimate sites redirecting to fraudulent pages).

    • Changes to web pages that include inappropriate content.

    • System performance issues (e.g., slow network speeds, web servers rebooting unexpectedly).

Where to Look for Evidence

Logs collected in network devices and applications can be used as evidence for investigating network

  • Functions

    • Handels high-level protocols, issues of representation, encoding, and dialog control

    • Provides logical connection between the endpoints and provides transport

    • selects the best pash through the network for data flow

    • defines how to transmit and IP

  • TCP/IP

    • Application layer

    • transport layer

    • internet layer

    • network access layer

  • Protocols

    • File Transfer (TFTP, FTP, NSF), Email (SMTP), Network management (SNMP), Name management (DNS)

    • Transmission control, User diagram protocol

    • IP, Internet control Message protocol, Address resolution protocol

    • Ethernet, fast ethernet SLIP, PPP, FDDI, ATM, SMDS, ARP, Proxy ARP

  • Network devices and application logs

    • Server /Desktops, Anti-virus, Business, Applications, Database.


Types of Web Attacks

  • Cookie Poisoning: Attack involving corruption of data stored in cookies used to track user behavior.

  • SQL Injection: Inserting SQL commands into input fields to manipulate databases unethically.

  • XSS (Cross-Site Scripting): Exploiting web pages to execute malicious scripts in the user's browser session.

  • CSRF (Cross-Site Request Forgery): Causes users to perform actions without their consent or knowledge.

  • Parameter Tampering: Altering parameters in a URL to gain unauthorized access or manipulate applications, involving SQL commands or changing session tokens.

Methodology for Investigating Attacks

  1. Interviewing: Gather information from individuals who noticed the issue.

  2. Locate Servers: Identify and take offline any servers or devices involved in the incident.

  3. Image Acquisition: Create forensic copies of necessary data, including web, database, and event logs.

  4. Correlation: Analyze collected logs and correlate data to construct an attack timeline.

  5. Log Analysis: Use encryption to protect log integrity while monitoring for active threats.

  6. Legal Documentation: Ensure every forensic process is documented for potential court cases.

Web Server Types and Logging

  • Major web server types:

    • Apache and IIS (Internet Information Services).

  • Apache Logging: Supports various operating systems (e.g., Linux, Windows).

    • Types of logs:

      • Access logs: details of incoming requests can include timestamps, types of requests, statuses.

      • Error logs: diagnostic messages and errors that help track issues.


Analyzing Apache Access Logs

  • Fields to look for:

  1. IP address of the client making the request.

  2. Request method: types like GET and POST.

  3. Status codes: e.g., 200 (successful), 404 (not found).

  4. Date and time of each transaction.

  5. Request size (bytes returned).

  6. User agent: identifies the client software.

Analyzing Apache Error Logs

  • Includes:

    • Time and date of logs

    • Severity level of errors

    • Process and thread IDs

    • Client IP addresses

    • Descriptive error messages (such as 'file not found').


Analyzing IDS Logs

  • Intrusion detection system IDS logs provide information helpful in finding suspicious packet types, detrmineig

Investigating Web Attacks on Windows-Based Servers

  • Use Event Viewer to look for suspicious events indicating potential attacks.

  • Review scheduled tasks for unusual entries that may indicate or harbor malware.

  • Investigate local user accounts for any unauthorized accounts created or suspicious activity logged.

  • Utilize command-line tools for network activity checking (e.g., netstat for session statistics).

Detecting Cross-Site Scripting Attacks

  • Definition: An attacker manipulates a vulnerable webpage to inject scripts that execute in users' contexts.

  • Techniques used by attackers to bypass detection include:

    • Hexadecimal encoding

    • Toggle casing movements

    • Use of regular expressions to parse incoming scripts effectively.

SQL Injection Attacks

  • Description: Attackers send structured SQL queries to manipulate databases.

  • Typical indicators include:

    • GET requests displaying SQL query patterns.

    • Use of tautology (e.g., 1=1) within query strings to bypass authentication mechanisms.

    • Monitoring for suspicious changes in database interactions or login processes.

  • Utilize tools like Snort and Splunk to generate alerts on suspicious activity related to SQL injections, using robust regular expressions for log analysis.

Conclusion

  • Key takeaway: Awareness of various attacks and robust strategies against web threats is essential to protecting applications.

  • Preparation for potential dark web investigations in future modules and developing defenses against an ever-evolving landscape of cyber threats.