>> Hello everyone and welcome to the course,
Identifying Web Attacks Through Logs.
The course was architected by Igor Vieira
>> with voiceover work from Jacob Pelzman-Kern.
>> Before we start, let me introduce Igor Vieira.
Igor Vieira has a bachelor's degree in
electrical engineering and
a graduate study in cybersecurity.
He also has some IT certifications.
He's been working with IT for around 15 years.
He's passionate about technology and
especially things related to networks and security.
He also believes that education and
knowledge have the power to change people's lives.
To have an idea about what we're
going to talk about in this course,
first let's check these two lines of
Apache web server logs.
Can you identify which one is suspicious?
Don't worry,
>> if you don't have experience in log analysis.
>> First, let's analyze this log.
Here we have the source access request, the remote IP.
Also, we have the HTTP method,
and the last is the web server result.
Both have the same IP address and HTTP method,
the difference is the web server result.
During this course, you're going to see
that the 200 means okay,
and 404 means not found.
Although there is another difference in
the logline, the requested file.
The first file is an image,
the second is a well-known Linux file that contains
all the passwords from the users.
>> This looks suspicious.
>> Why would someone ask for the passwords?
After the previous slide,
maybe you're thinking, well,
who should take this course?
You should take this course if you are a web developer
>> or a server administrator that wants to
>> understand web application attacks,
if you're a SOC analyst interested
in understanding web application logs,
if you were a senior administrator
who wants to build better correlation rules,
and if you're any IT professional who
wants to understand more about web attacks.
To be successful with this course,
some of the prerequisites are
basic operational system administration skills.
A basic understanding of TCP/IP,
HTTP, and web applications,
a basic understanding of web application attacks,
and basic web server administration skills
in Linux and Windows.
This course, we'll use presentations and quizzes.
During this course, you're going to use a lab
and we perform some attacks in this lab.
The attacks will generate logs and we will analyze
them so each attack will have its own logs.
The course structure will be to
review web applications and infrastructure,
review the web server logs,
simulate some attacks like SQL injection
>> and cross site scripting to generate logs,
>> and use those logs to identify the attacks.
To make things more clear,
let's talk about course objectives and goals.
This course was built to give you
a good understanding of web server logs and to teach
you how to use those logs to
identify web application attacks.
The summary is understanding
a web server log and its information,
identifying suspicious activities,
and identifying web application attacks.
The goal is that you can get some logs
>> and say if there is a suspicious behavior
>> after log analysis.
>> In this first video, we introduced the course,
give a description of the course and its structure,
and we ran through course objectives and goals.
In the next video, we will start the review.
We'll start with web application architecture,
followed by WWW and web servers,
and after HTTP and HTML.