>> Hey everyone, welcome back to the course.
In the last video,
we wrapped up our discussion on network forensics.
In this video, we're going to talk
about web application forensics.
Just a quick pre-assessment question here.
A buffer overflow attack is
an unintentional leakage of sensitive information.
Is that true or false?
That's actually false.
The actual answer here will be information leakage.
Now buffer overflow basically is
used try to write at least CO2
adjacent memory locations to then allow
the attacker to pass some type of malicious code.
The web application architecture,
we basically have our client or web server,
to the client is like us,
we're trying to surf the web,
go to google or something like that
and so we're sending that request to the web server.
Then we also have the business
and database layer as well.
For example, we've got the client,
that's going to be us with a web browser
using plugins like Silverlight, JavaScript,
Flash, to some extent that
even though that's been disabled in
most browsers so we're
doing that through our smartphone,
our computer, going through the web that way.
Then we move into the Web Server layer,
where we've got the presentation layer inside of
there so that's things like using maybe a proxy server,
your web cache, server container,
your authentication, your login, things like that.
Again, these are just some general things you
want to just remember for the exam,
your business layer so using things like C++ or .NET,
even legacy applications, and then the database layer,
things like your Cloud services,
your actual database in those things.
Web application forensics.
Where can we get information from?
Well, we can get this from our needs or our heads.
Again, network traffic or a network intrusion detection
system or our host
intrusion detection system depending on,
it could be on our server,
could be on a workstation,
getting information from the browser cookies.
Even, just other areas of the servers as well.
Challenges, so possibly we don't have logs.
Generally, inadequate logs is
going to be our main challenge there.
We may not be getting information from
intrusion detection or intrusion prevention systems.
It's possible that even organizations,
you don't see too much nowadays,
but it's possible that you have
organizations not even using
an intrusion detection or
intrusion prevention system in any capacity.
Then also training, so we've got to make sure that
our network administrator actually knows
to leave the logs alone,
leave the system alone.
Let us come in first and get an image of that system,
a lot of times they want to take it offline or turn it
off even so we just want to
make sure we have them trained up so we can
actually get the information that
we need as a forensic investigator.
Different indications of web attack.
Obviously with like a DDos,
the number of incoming requests.
Like all of a sudden you have
4 million requests coming in whereas,
you normally have 100 people come into your website.
We can find some information in
the HTTP request header so if the attackers use of
some common tools like Sqlmap or Netsparker
it might leave some fragmented data
in there that we can harvest.
Also fingerprinting, if we
can recognize fingerprints that
are from previous attacks even not our organization,
but other attacks as well
>> that happened and that's where
>> we want to keep our IPS and IDS up to date.
Because a lot of times there'll be
using file signatures so it can
help us prevent against a lot of
different attacks. Then also the geography.
If all our web traffic normally comes from the US,
and then all of a sudden we're getting a lot
of traffic from North Korea.
That could be an indication that that's an attack.
This video, we just went
over web application forensics at
a high level and the next video we're
going to jump into the OWASP Top 10.