>> Hello and welcome back to the course,
Identifying Web Attacks Through Logs.
In the last video, we talked about
injection attacks and SQL injection attacks.
In this video, we'll talk about
another injection attack called file inclusion.
Let's see the video objectives.
The video objectives are
understanding the local and remote file attacks,
and identifying these attacks using web server logs.
First, let's discuss file inclusion attacks.
As we said before, it's an injection attack.
It's usually caused by
incorrectly using input validation.
It's common to see directory transversal characters.
These are two types;
local file inclusion that access and
execute the local files or commands,
and remote file inclusion that
access and execute remote files or commands.
File inclusion is a server-side attack.
Here you can see how file inclusion works.
First, local.
Our request is sent to the server and answered,
so it all happens in the same server.
Remote file inclusion is a little different.
The user sends the request through the web server and
the web server sends
the request to another web server, a remote server.
That's why it's called remote file inclusion.
You need two different servers.
In our lab, we have a web application
that is vulnerable to the file inclusion,
both local and remote.
Here's an example of local inclusion.
Passwd is a file that contains
the passwords for all the users in a Linux machine.
You can see the directory transversal characters
which change their directories.
The result is the passwd file
will be read and displayed in the webpage,
as you can see in the picture.
Now, let's analyze some logs together.
The first logline is a normal request.
The second logline is a direct
>> request to the passwd file
>> and the web server answer is not found, the 404.
The request didn't answer.
In the third line,
we have a 200 as our answer,
so the web server found the passwd file.
Notice the difference between the two requests.
The next line is the same request but encoded.
As you can see, it worked.
The web server answered the passwd file.
Since the passwd is local,
this attack is a local inclusion.
In these examples, we had access to critical files.
It's also possible to execute
>> commands on the web server.
>> In this table, we have a summary of
the most common target files for each personal system.
If you want, pause the video and take some notes.
Now, some directions to help
you identify the local file inclusion.
Look for operational system commands
and files, new files,
encoded requests, and slashed on the requests.
You can go to this website and look for
more examples of local file inclusion.
The next is the remote file inclusion.
We'll use the same lab.
The difference between remote and local file inclusion
is where the resource is located.
The remote file inclusion needs to
access another server's files.
In our example, we
will access the Google website from our lab.
In the result, you can see that
the Google search bar is loaded in the lab web page.
The remote server is a Google server.
The remote file inclusion accesses remote servers.
Now, maybe you're thinking, "Well,
I don't have access to the remote server.
Can I find the remote file inclusion attack logs
on my web server?"
Yes, you can find
the logs of the attack on your web server.
Access on other web servers is
a consequence of the attack.
Your web server server is the target.
That's why we will have the logs.
Let's analyze some logs.
The first line is the request to the vulnerable page.
Notice that there are some log fields missing,
like user agent, IP address, and date and time.
They were removed to save space.
In the second line, we have the malicious request.
Another page is accessed from our webpage,
in this case, the Google webpage.
All the other logs are
our web server requesting the Google web page.
Our web server is downloading the Google webpage.
That's why we have similar logs,
most of them are pictures.
The full log of this request is bigger.
Here we only have a small part,
but all the requests are similar.
You can use the same directions to
identify remote and local inclusion.
Here are some directions more related to remote.
Look for weird requests.
As we showed in our other example,
requests for another web server like
outside of traffic is suspicious.
If the server is accessing a remote server,
maybe you can see an increase in
web server download traffic.
Here too, look for encoded requests and the user agent.
Look for uncommon user agents or
>> vulnerability scanners.
>> Post-assessment question.
Analyze the web server log
below and choose the type of attack.
You can pause the video if you'd like.
The answer is number 4, remote file inclusion.
Let's analyze the log together and see why.
We have the IP address, date and time,
and the requested file, and we have the getMethod.
If you look at the requested file,
you can see there's another address in the page,
so we have a remote file inclusion
because we're trying to access a remote server.
Here is the Cybrary webpage.
All the other fields are okay.
We have the 200, that means okay,
we have the referrer and the user agent.
For the next question,
analyze the web log below and identify
which webpage is vulnerable to file inclusion attack.
Here you have the request and you have
a small part of the full webpage,
but you can see the malicious request.
Although if you look to the referrer,
we can see there's no webpage.
Remember that the referrer can be crafted too,
but sometimes it can help.
In this case, it's possible to find
the vulnerable webpage. Here's the answer.
Video summary. In this video,
we learned about local and remote file
inclusion attack and their differences.
We used it in our lab to generate
some web server logs and analyzing the web server logs,
we identified both types of attacks;
local and remote file inclusion.
We also gave some directions to identify the attacks
like weird requests, encoded requests,
user agents requests with
operational system commands or files,
requests with many slashes,
and some specific directions
for the remote file inclusion,
like the request to the outside.
In the next video, we'll analyze cross-site scripting
attacks and we'll identify
the attack using web server logs.