Log files record events and anomalies to help debug issues, trace errors, and check for intrusions. Common log files are stored in /var/log and include kernel logs, web server logs, and logs from programs like iptables and Snort. Log files can help trained security analysts determine if activity is legitimate or indicates potential attacks like SQL injection by examining details like file dependencies, request types, and network scan patterns.

1. Big brother is watching you Stefan FODOR(backb0ne fl00d3r ) Lucky-Day from May Log

3. Example..

4. Iptables and logs

5. Introducing snort

6. Live Demo?

7. Question?

9. Warning

10. Errors

12. Code

13. Error/warning message

15. Trace errors

16. Check for intrusions

17. Statistics

18. /var/log

19. /var/log Kernel Logs Log, warn, err dmesg Web server apt logrotate

20. For the untrained eyes

21. For the trained eyes File dependency – legit request Legit request SQL injection? ?

23. Store iptables logs to /var/log/iptables.log

24. $ nmap 192.168.1.20

25. Nmap and iptables

27. Set rules for nmap

28. Configured log file

29. BASE “interface”

30. Run nmap

31. Regular Nmap Scan

32. Stealth Scan + OS Det

33. Live Demo? (As needed)

34. Questions?