Home / Labs / Trace the Web Attack

Trace the Web Attack

The attacker attacked the web app too. Find SQL injection, traversal, and shell uploads in the access log.

Open this lab

Commands practised here

• wc -l /var/log/access.logCounts total requests in the log.
• grep -i 'select\|union\|from' /var/log/access.logFinds SQL injection attempts.
• awk '{print $1}' /var/log/access.log | sort | uniq -c | sort -rnRanks IPs by request count.
• grep '\.\./' /var/log/access.logFinds directory traversal attempts.
• awk '{print $10}' /var/log/access.log | sort -rn | head -5Finds the largest response sizes (data exfil).

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Enumerate the Users
• Write the Report