Hey everybody welcome to the final video of the Linux OS module.
Now this module we're going to go over some of the Linux logs.
Now it's important to understand what's logged and where and a base and a basic install.
Now logging can change things can be logged in different places people change to custom logs.
Sometimes they might have the logs temporarily stored there and then they're shipped off with something
like Splunk or sis log to other places.
So understanding what the basic logs are and where they're at is is crucial to a red team or it goes
into a lot more than just being able to search for information but it also plays into different types
of attacks.
So there's an attack called a L5 for local file inclusion where you're able to include a local file
into the web page.
Now most people just hit up the ATC password to get the hash or ATC shadow to get the actual hash itself
however you can take.
You can use the access logs and the authentication logs and a multitude of other different types of
logs to gain access to the machine.
Now I'm relieved that you guys for homework to search up Elif really quickly and then look at some techniques
that are done to gain access to a machine there's something called log poisoning.
Now don't dig too deep into it.
We're gonna have a whole video dedicated to just l5 how it works how to do log poisoning so we'll go
over it at that point but I just want you to be familiar with it to understand where logging is important
so understanding where apache logs its access logs and in one particular case would be would be important
because you're able to poison that particular log.
Now most logs are stored in this directory var log.
So if you do let's dash Al we see a few and here we see the off logs for authentication we see.
Let's see here we have the kernel for the kernel log.
We have this log.
So these are pretty pretty common logs so if we do tailed ash and 50 for the off log so we can see we've
had sessions opened up for route sessions closed executing commands.
So it's sometimes this will hold some valuable information about what the system does looking at logs
to understand who's connecting to the system.
So if somebody SSA aged into here you can find out who is commonly SS aging everyday for example and
then you can start planning attacks around that.
So it's it's very important to to always scan logs and I'm not telling you to go through and hit and
look at every line of every log.
But understanding what's inside of a log and where the information is stored that you're looking for
isn't port is an important aspect of this.
So take some time look at some of the logging.
I've added a bit of some details for standard logs below the video.
So go ahead and take a look at them view the logs see what you can find.
For example you can see we ran the command LSA off LSA left on var log.
So simple stuff like that get to get familiar with the process you're going to be looking at logs a
lot as a red team are just bound to happen whether it's your own or the systems.
So just keep keep an eye on it know what's there and know what you're going to expect.