Investigating Web Attacks: The Forensics Behind 404s and WTFs 🕸️

Learn how to investigate web-based attacks by diving into web application forensics, analyzing IIS and Apache logs, and uncovering sneaky exploits like XSS and SQLi in real-time.

TL;DR 🧠

Web forensics = detective work on websites. If your site’s acting possessed or your traffic log looks like The Matrix, someone’s probably up to no good. Here's how to catch them. 🕵️‍♂️📊

Wait, What Is Web Application Forensics?

Web application forensics is all about analyzing compromised web applications and the servers they run on to:

• Reconstruct the attack timeline

• Identify what was exploited

• Understand what was accessed or stolen

• Prevent it from happening again

Whether you're hunting an XSS payload in a contact form or chasing down that one rogue PHP file named lol.php, web forensics puts you right in the middle of digital battlefield tactics.

First Things First: Log Files Are Your BFFs

When your site is under attack, your web server logs are like surveillance footage. If you know what to look for, they’ll spill all the tea. ☕

Common Web Servers:

Logs reveal the IP address, pages visited, timestamps, status codes, browser types, and more.

Both record things like:

• IP addresses

• Requested URLs

• Response codes

• HTTP methods (GET, POST, etc.)

• User-agents

Real Talk: What to Look For

🔍 Suspicious Activity Patterns

• Repeated 404 errors (recon scanning)

• 500 server errors (script failures)

• Requests with long query strings (possible injection)

• Requests to admin pages or .env files

Phase 1: Spot the Attack Type

Here are a few of the usual suspects when your site’s under siege:

1. SQL-style Injection

Clue: A URL might include a query like ?id=(1)( ' ) ( O R ) ( '1' ) ( = ) ( '1' )

🧠 What it does: Attempts to trick your database into revealing more than it should.

🛡️ Log Tip: Look for suspicious symbols like single quotes, OR, or double dashes disguised like this: ( - )( - ).

2. Cross-Site Scripting (XSS)

Clue: A browser request with something like ( < )( s c r i p t )( > ) alert( 'gotcha' ) ( < )( / s c r i p t )( > )

🧠 What it does: Sneaks scripts into your site that run in other users’ browsers.

🛡️ Log Tip: Watch for encoded versions like %3Cscript%3E or suspicious <script> patterns—defanged here for safety.

3. Remote File Inclusion (RFI)

Clue: A query might look like ?file=( h t t p )( : )( / / ) evil-dot-com ( / ) badstuff.php

🧠 What it does: Loads a remote malicious file into your application.

🛡️ Log Tip: Look for full URLs embedded in parameters.

4. Directory Traversal

Clue: You’ll see things like ..( / )..( / )..( / )etc( / )passwd

🧠 What it does: Navigates outside the web root to peek at sensitive files.

🛡️ Log Tip: Flag any repeated ..( / ) chains in the logs.

5. Brute Force Login Attempts

Clue: The same IP address making hundreds of login attempts in a short period.

🧠 What it does: Tries common passwords until one sticks.

🛡️ Log Tip: Look for repeated ( P O S T ) requests to endpoints like /login or /admin followed by ( 401 ) or ( 403 ) status codes.

Phase 2: Build or Reconstruct the Timeline

Timestamps are your best friends in incident response. Here’s how to play detective:

1. When did it start?

2. What was the first point of access?

3. What was targeted or accessed?

4. Was a backdoor uploaded? (Look out for mystery .php files like shh.php or cmd.php)

   
   
   
   
   

   🛡️ If you spot something like lol.php, congrats! You’ve found a web shell. That’s the hacker’s “control panel” for wreaking havoc.
   
   
   
   

Phase 3: Lock It Down and Report

Once you've ID'd the threat:

• 🚫 Block offending IPs

• 🔧 Patch the vulnerability

• 📦 Take a snapshot of the system (using tools like FTK Imager or Autopsy)

• 📝 Create a detailed, time-stamped incident report (NIST 800-61 standards work great here)

“If it’s not documented, it didn’t happen.”
— Your friendly forensic analyst

TL;DR Recap 🎯

• Web application forensics helps you find, analyze, and fix security breaches

• Web server logs (from IIS or Apache) tell the story of who did what and when

• Be on the lookout for defanged clues like ( <script> ), ( OR '1'='1' ), and ( ../ )

• Reconstruct timelines and act fast to block, clean, and document

• Tools like The Sleuth Kit and FTK Imager are lifesavers in the investigation phase

Next Up in the EC-Council DFE Series 🧠

If this web attack detective work got your gears turning, just wait ‘til we dig into dark web, email crimes and malware forensics whodunits. 🤓📬

More case studies, real-world examples, and simplified step-by-steps are coming soon. Until then, keep your logs clean and your sites mean. 🔐

Liked what you read? Bookmark us and share this article on social media to help others discover it too.