Lab
Exercise: Web server log file analysis
In this lab, one of your web servers was compromised and you have to investigate the compromise. You have been given the log file from the web server. Analyze the log file with any text editor and answer the following questions. The web server.log log file can be found in the GitHub repository folder for this chapter https://github.com/PacktPublishing/Hands-On-Ethical-Hacking-Tactics:
- What is the data/time range of the log?
- Were any proxies involved? If so, which ones?
- Which pages were clients accessing with GET requests?
- What version of WordPress is being used?
- Which page(s) is HTTP POST going to?
- What proxy scanner was being used?
- A password was set. What was the ID and password set?
- What is the name of the bot that accessed the system, and what IP address did it come from?