Home / Labs / Crack the Full Investigation

Crack the Full Investigation

Four log files, multiple attackers. Build the complete attack narrative from raw data.

Open this lab

Commands practised here

• grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort -uLists unique attacker IPs.
• grep 'Accepted password' /var/log/auth.logShows all password breaches.
• grep '192.168.1.50' /var/log/access.log | awk '{print $7, $10}'Shows URLs and response sizes from an attacker.
• ls /var/log/Lists all log files to separate real sources from distractions.
• grep -h '192.168.1.50' /var/log/auth.log /var/log/syslog /var/log/access.log /var/log/messages | sort -k1,2 -MMerges all events from one attacker across all logs.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Forensic Disk Capture
• Verify Against Threat Intel