>> Hello everyone and welcome back to the course,
Identifying Web Attacks Through Logs.
In the last video, we talked about
log analysis and its challenges.
We also finished our reviews.
In the previous module,
>> we talked about important things
>> related to web applications and log analysis.
This module will be more hands-on.
We'll perform some web applications attacks,
and then do the log analysis.
To start, we'll talk about web application attacks.
As such, our learning objective of this video is
understanding the differences between
infrastructure and application attacks,
introducing the OWASP top 10 project,
reviewing some common web application attacks
and understanding the URL components.
Let's begin. First,
let's remember some web application components.
Do you remember when we talked about TCPIP and HTTP,
and I said that HTTP uses TCPIP to communicate?
For web applications to work,
they need a lot of components.
Let's check some of them.
>> In the top layer,
>> we have the web application.
PHP and HTTP are related to this latter.
After, we talked about
the web server that holds the application.
Web server softwares like Apache and Nginx
>> are in this layer.
>> There are two components they need
>> to run in some place.
>> This place is a server,
but it could also be a personal system
like Microsoft Windows or Linux.
This is also true for virtual machines.
We can also add database servers
and application servers to this layer.
In the last layer, we have
the network hardware and
services that make the communications possible.
However, this is only one way to
understand the web applications and their components.
It's important to know
that each component can be attacked,
and since web applications
depend on all of these components,
an attack on any layer
can affect the entire web application.
The three layers under
the web application are infrastructure.
In this course, we'll focus on the top layer,
the web application attacks.
This is a typical infrastructure
which would support a web application.
Another design is possible,
but will be so different from this.
To access our page,
the user will send a request to the web server,
and the web server will access the other components.
That means that
all this infrastructure can help with logs.
Again, if we have more logs,
we have more information during the investigation.
You have the same web application
and the same infrastructure.
How do you think you can identify
malicious user and an attack?
To identify an attack,
you need to know about the attack and
the web server logs will help you
>> to identify the attack.
>> As we said before, the web applications
are client-server oriented.
Based on this model, we can classify
web application attacks in two types.
Client-server side, that usually explores
a vulnerability and uses an endpoint
where it's located, i.e., the web client.
The second classification is server-side attacks.
In this case, the target is the server.
In this course, we'll focus on server-side attacks.
Since the web server is a target,
we can use its logs to identify the attack.
To talk about attacks,
we need to talk about vulnerabilities.
One definition of a vulnerability is from NIST,
which says that a vulnerability
is a weakness in an information system,
system security procedures, internal controls,
or implementation that could be
exploited or triggered by a threat source.
In our course, we'll change
information systems for web applications.
The attacker is someone who
tries to exploit the vulnerability
and all the vulnerable things are the attack surface.
Here's some more definitions.
Risk, the possibility of something bad happening.
Target,
>> for us, web servers and web applications.
>> Attacks,
>> which are basically any action that
someone is performing trying to exploit
a vulnerability or not to
cause any impact on the web application.
We are talking about a tax,
but do you know what
the most common web application attacks are?
To answer this question,
we'll use our definition from the last few slides.
Based on that definition,
we need a vulnerability to have an attack.
It's actually better to ask,
what are the most common vulnerabilities?
To answer this question,
we'll use the OWASP Top 10 project.
OWASP, which means
Open Web Application Security Project,
is a project that catalyzes the catalogs,
the Top 10 vulnerabilities for web applications.
In this course, we'll use a version launched in 2017.
The first version is from 2003.
Check the OWASP website if you want more information.
Here we have the comparison
between 2013 and 2017 projects.
In this course, we'll use
examples of some attacks like injection,
broken authentication, security misconfiguration,
cross-site scripting
using components with vulnerabilities,
and the last one, which is not an attack,
but it's still related to our course.
To talk about web attacks,
we need to understand the URL components.
URL stands for Uniform Resource Locator.
It's a type of Universal Resource Identifier.
User agents use the URL
to request information from the web server.
Each web application has one resource locator,
which makes it possible for our web
server to host main applications.
URL is also known as a web address,
and has multiple parts.
Now, to understand its components.
A scheme that identifies the protocol, host,
or domain that can be followed or not
by a port path that identifies the resource they
want to access and
the query that's used to pass some information.
If we look at the Cybrary login page,
we can find the components.
A scheme or protocol in this case is https,
www.cybrary.it is the host or domain.
You can see here that we don't have
>> the port information.
>> It'll use the 443 because of the HTTPS scheme.
After the slash is the path
and after the question mark is the query.
It's important to know that most of the attacks are
performed in the path or in the query components.
If you want to know more about this,
check these two websites.
Another important thing is encoding.
URL's can only be sent over
the network using the ASCII character set.
To respect this rule,
some of the characters need to be encoded in ASCII.
The encoding words change
the unsupported character for a percent,
followed by two numbers.
The two numbers are the hexadecimal digits
of the encoded character.
For example, the space isn't converted to
percent 20, like in this example.
Another use is to convert different rights systems that
don't use layering choice like Arabic or Chinese.
Also, encoding is used to perform attacks,
although a percent in the request
doesn't mean that this is a malicious request.
Percent is used in both good and bad actions.
For example, this cybrary request
has multiple percent signs, but it's safe.
To make things more clear.
Let's look at this request.
We have this big request here with many percent signs.
If you know about SQL,
you'll also notice some SQL works
like SELECT, WHERE and others.
Could you find those words? It's hard to find.
There are many percent signs
and to help with finding those words,
we can decode it.
There are many sites that can help with decoding.
After the decode, we'll be
able to find out what it really means.
Now, it's easy to see the SQL words in a real request.
In this course, you'll learn that
this particular request is an SQL injection attack.
Then one more thing, a typical user will make
many requests throughout this one page.
This means that the user will
request different paths and different queries.
Here's an example of one user requesting one website.
One access generated three lines of logs.
Other requests are from the same IP address,
the same date and time, but all are different requests.
It's common behavior in modern webpages to
have many requests throughout a single webpage.
Knowing your web application
will help you to identify this behavior.
Post assessment question, is
this information true or false?
Considering a basic web infrastructure,
only web servers are susceptible to attacks.
This information is false.
Remember, web applications depend on
many components and all of them
>> can be targets.
>> Next question.
>> Which of these vulnerabilities are present in
the 2017 OWASP Top 10 project?
The answer is injection and security misconfiguration.
The other options are related to
>> infrastructure attacks.
>> For the last question, check this information.
Web requests with a percent sign on it are malicious.
Is it true or false?
This information is false.
A percent sign is not always malicious.
It can be used to transfer to
a different write system or to use
unsupported characters.
>> Video summary.
>> In this lesson, we talked about the differences between
web application and infrastructure attacks
based on a layer approach.
The definition of an attack and a vulnerability.
The OWASP Top 10 project.
We also reviewed URL components and URL encoding.
In the next video, we'll begin our log analysis,
starting with vulnerability scans.