Hello everyone in this lesson. I will talk about the HTTP
analysis and attacks.
Now firstly let's talk about the HTTP forever.
The HTTP is a client service
protocol that is based on clear text. It
is the typical type of network activity for
requesting and serving web page and it
is not prevented by any network boundary by
default. So HTTP is
a must-known protocol in traffic analysis, since
it is unencrypted and serves as
the backbone of online traffic, so
Now let's talk about the HTTP response codes.
HTTP response codes are
important when analyzing Network traffic
because they provide information about outcome
of a client's request and the
status of the communication between the client
and the server they can
be used to identify and terrible should issues with
web applications and such as
broken links or other indication failures
and server errors.
For example, if a large number of requests are
returning 400 for not
found response, it could indicate that
a significant number of links on the
website are broken. So this could be
a series issue for a user experience and
some SEO and
similarly if a
large number of records are returning
a 500 internal server
error. It could indicate that
there is a problem with the server or the application running
on it.
And in addition to this HTTP response
codes can also be used to detect and
prevent security issues. So
for example, if a large number of
requests are returning 401 unauthorized
or 434 billion
response, it called indicate that
an attacker is attempting to to gain
an authorized access to the application.
Furthermore it is also important to watch for abnormal
behavior, like a spike in
certain response codes. It could indicate a
distributed denial of service DDOS attack
and or data
port or script is scrapping
your website. So in
summary HTTP Response Code provide valuable
information, then analyzing
Network traffic and can use to identify
and terrible shoot a wide range of issues related
to web applications and network
security. Now, let's look at
how we can make HTTP analysis
based on response State score values.
And I am typing the first sample filtering expiration.
For example, I'm taking the 403
as Response
Code here.
And I am asking it to fetch
me package with the Response Code value of 403.
You know that the 403 Response
Code means that there is no access to
the requested URL. So 43
is meaning that the
Forbidden requested URL and
no access to the request to URL. There
are a few possible reasons why you
might see many 43 forbidden
packets in an HTTP traffic.
First one is Miss configured access controls
and the server might be
configured with strict access controls that
are blocking legitimate requests. And
the second one is Brute Force
attacks. An attacker might be attempting to
gain unauthorized access to a specific resource by
repeatedly, trying different credentials or
methods.
And the third one is application vulnerabilities
a vulnerability in
the web application called hello an
attacker to perform an action that server is
blocking.
And the other one is web scrapping or
crawling some web scraping or crawling
tools might not properly follow the
rules of you know, robots that txt
a file and which
can result in 434bidden errors.
And the last one is D those attack.
A distributed denial of service leaders attack
could all load the server and cause it
to return 434-bit and
for all requests.
So in order to determine if the 4003
forbidden packets are
the result of a Cyber attack, you need to
analyze the traffic in more details such as the source
IP address the timing and
the frequency and the target
URL and the HTTP headers.
So likewise you can
examine 400 as
HTTP Response Code. HTTP
400 packets are
packets that stand for bad request.
Furthermore the number frequency and
Source IP address of these packets can
be investigated.
and
on the other hand in the same filtering expression.
It is sufficient to
set the Response Code value to one
hundred.
in order to investigate 400 HTTP
packets
So and another important HTTP code
is 401. It
means unauthorized and
that is server didn't understand the
request message.
400 HTTP response means server didn't
understand the request message. Finally. You
should look at HTTP code for
405.
And it means method not a lot
because can attempt to attackers can
try to attempt different HTTP methods.
and
now let's talk about the user agent heater
parameter, which we
can see commonly.
in an HTTP message
As you know, the user agent is a string data
web client for example,
a web browser and it is a
header of HTTP protocol.
And you can see the user agent
like this in an
HTTP packet and the user
agent field.
It is critical for a security analyst.
To recognize anomalies indications
on packet beats and pieces.
And this information can be
used by the server to tailor its response
to the specific client or to track which
types of clients are accessing the
site. So the user agent
string typically includes information
about the client software and the device. It
is running on such as the browser type and version
the operating system and the
device type
and it is critical for a security analysis to
recognize anomalies indications on
packet piece and pieces as
I told before the user agent field
is a great resource for detecting anomalies
in HTTP data.
In extraordinary in extraordinary situations
takers effectively change
the user agent data.
Making it appear company the
legitimate. So for example a typical
user agent string for a web browser
might look like this. Let
me show you.
in the PK file
in the washer PK file
and
In order to see only the HTTP packets.
I'm writing that filter expression.
As HTTP, it is
enough to only see the HTTP packets
and click on the enter.
So
and that's it. And now we are seeing only
the HTTP packets
as you can see in this window.
and when we look at this packet
the packet number 62
and
let's expand the hypertext transfer protocol
field in here.
And when we look at the user agent field, you
can see the some browser
information about the client
and
Mozilla and it's version information
is 5.0 and
the operating system information such
information about the
operating system and the
browser version.
And usually agent in
here is an example and this
user agent makes
up of Mozilla 5.0.
And some other operating system information
we have in here. So this
is a normal and usually usually agent
example a user agent
string is considered a abnormal if if
it doesn't conform to the format specified
in the HTTP 1.1 version
specification, or if it
contains unexpected or
suspicious values.
And for example a user agent string that contains
some spatial strings
or white space in unexpected places
will be considered abnormal additionally
user agent strings
that are too long too short
or are of any unexpected format
are also considered abnormal.
of keep in mind that
Now, let's look at the filter Expressions
to find some suspicious
patterns.
Now with these in mind we can construct
a filtering expression. Let's suppose
that the clients in our Network use only
Mozilla.
As a web processor and in this case,
we don't expect anything other than
this web browser.
Other than Mozilla string in
the user agent theater and we
can use this string model string to
find suspicious user agent strings.
and we write filters as
now
to say only to say show only HTTP
traffic V type http.
And sister will be
a second statement in this traffic be put
and operator.
between them
and the second statement is like this.
http
we use the matches filters because
we don't want to get stuck with the case sensitivity.
The second statement
brings us here is
the second statement in here and we
can
Make within a parenthesis and
the second statement in
here brings us
packets with Mozilla in the user agent headers.
And since we want
to case where the string is not passed
we put and not operator at
the beginning of this expression of
this statement written exclamation point
now like this.
And this is our filter expression filtering expression
in order to find without.
modulus string in the HTTP user
agent
So now let's copy this filtering expression
and apply it to our PK file.
and to
In this display filter field. I'm
wasting it
like this click on the end.
So now we have some packets which is
associated with our filtering expiration and
let's take a look at the packets in order.
First one is the packet with the
number 55 and click
on this packet.
And when we look at this packet in this
packet, there is no user agent field and
let's jump to the next one.
So
there is also no user
agent field agent header
and
to the next one.
or there is a user agent as you can see and
And its value python request if you
see a string like python records
in the user agent either it may
indicate that the client software making the request is
using the Python programming language and
the records library to make
the HTTP request and this
isn't suspicious finding by
itself as many developers use the
Python programming language
and request library to write
scripts some script and applications that
make HTTP requests.
However, it is important to consider the
context and other information available to
determine if the request is malicious or
not.
For example, if the request is being made to
a server that shouldn't be receiving characters
from Python scripts or
if the request is attempting to
access sensitive information. It may
be more likely that the request is
malicious.
The it depends on another some
parameters and theater information.
Additionally, you can check the IP address
of the client the timing and frequency of
the requests and if the request is
part of a large a larger pattern
of suspicious activity
and
it is also important to check the heaters as
I told you the payload and parameters
of the request to see if they
contain any signs of malicious activities.
So now let's talk about the common a
common common detector type as
log 4G attacks. Let's
talk about the log 4G effects
and log4j attack quickly
starts with a post request.
The HTTP method would be
a post message would
be paused. So it is useful
to investigate post packets packets to
detect such attacks.
I mean this type in here
like this.
this type packets post packets and
there are known clear text patterns.
Which indicates the lock 4G attacks
and these clear text
patterns like this. I want
to show you.
for example, it can be J and
the I
and call them.
and
have that
if you see the patterns like this, this is
a sign of
log 4G attack
And therefore if you want to directly access packets
containing the work 4G
attacks, you can use the following the like
this building expression.
Since the log4j attack
technical starts with a post request first.
We should type A filter expiration
to perfect the
post packets and you can
write this HTTP Dot
request
that method
because we want to see the postmet packets.
is equal to
cost
This is our first statement that we want
to see.
and the
Second for for the second statement. We
should put a put an operator and
And then we can write the second statement
that we want to filter out and
the second statement we are
looking for is because there are packets that
pass the JJ and
d i l depth pattern string
in the user agent. We should
type this filter.
expression
http
.useragent
matches
J and the I
and the column
symbol
and L
so
let's look at this.
This is our
filtering expression in here
so you can use this filtering expression to directly
find the some log 4G
attack packets and
the result. Let's look
at the result of this building expiration and
I'm copying this filtering expression
to use in Russia.
now
let's put in this field.
the filtering expression
And now you can click on enter to
see the result.
So the result is great.
We found the packet we were looking for directly and
the attack packet. It became
really pinpoint. Let's take a
closer look at the unusual and
some unexpected
patterns in here
then we look at the user agent. We are seeing
the unusual and unexpected characters
and some
special strings
in here as you
can see. This is unusual and extraordinary statement.
But and this is a typical lock for
G attack pattern and the sign
you can see in the user agent
field. And with this expression
with this filtering expression. We
have found the packet and
directly and in an effective
way.
So let's take a closer. Look
at the look at the unusual and
unexpected the strings in
this attack because this can
be a remote called execution and
our CE attempt and
you can use
the windows tool to look
at
in details
and you can choose the show packed bytes.
And as you can see in here.
Are user agent strings?
And this is really interesting pattern
and in this step
you can use any converter tool
to convert these special characters into
human readable format. When I
because I have converted
before this special
characters from Days 64
very 64 type to a
readable text format and I will show you
a directly the result of this.
Special characters and I have
converted these special characters to
readable format before the lesson
and I have used it.
Common tool in order to do this and
you can use any converter tool to
convert is special characters
and you should
take this part only to convert
because you need to this part.
To convert a plane text to
convert a human readable
format and this part.
is in base 64
type and you can take
exactly
this part
and you can convert with any converting
tool to a plain text.
Okay. Now I will show you the result
of converting this part of
a strings and
This part of strings corresponds to
this plane text part.
But this is the result of converting now.
I am pasting in here.
And this is the converted situation
of those special
characters. I want
to type in again.
the special
characters
so you can
take this
but these special characters.
corresponds to the
this code
When you convert this.
Special character part you will
obtain this code corresponding as
corresponding situation. So
this code when it
is executed will download file.
will download a file which is called
LH and Dot sh and
Will download this file and
from the specified URL as
you can see in here.
Change and it will change
with this chord plus
X comment. It will change
its permissions to make it executable to
make it executable it
execute the plus X parameter
and then run
it.
run this script file
So this command is like the art
of a log4j attack pattern which
is a type of attack that exploits a vulnerability
in the log4j library to
inject malicious code into some applications.
In this case, the attacker is
using the command download a
shared secret like this and from
a remote server.
The attacker is using the command to download a
shot script from a remote server and
10 execute it on the
compromised system on the
compromised system. So this child script
may contain some rice malicious
payloads some malicious
payloads such as
And that can be first first download
and execute additional malware
or it may contain in order
to connect to a command
and control server and it
may contain that opening a
reverse shell to allow the
attacker control the compromise system or it
may contain also that performing
Adidas attack or download
and execute other
scripts or to collect some sensitive information
and it is important not this
specific command, maybe changed and
URL maybe different but the
purpose is still the same.
And as this is a malicious command, it
is important to take action as soon
as possible to prevent further harm and
is called include disconnecting the
compromise system from the network analyzing
the system at the downloaded file and
blocking the IP address from which the
command was download.
And yes, this command can be considered an
example of remote code execution.
And remote code execution is a type
of attack, you know that allows
an attacker to execute some codes
on a remote system. And the command
in question is being or the
command in here is being used
to download and execute code
on the compromise system. So in
this case,
So as a result in this case, the attacker
is exploiting a log 4G vulnerability
to inject the command into
a application and then executed
on the compromise system and
the command downloads a shell script
from a remote server and then runs it
on the compromis system potentially allowing
the attacker to execute.
They're they're called and gain control
of the system.
so
That's all about log 4G attack.
And this was an example of log4j attack.
That's all for now. See you on the next video.