OK, this is the last thing that we have left to cover.
Now, this is not necessarily a bug, but it's something that could be useful for you to know and that
is insufficient logging and monitoring.
Now, most of the websites and applications and all of that have their own logs and log is something
that is tracking different traffic, perhaps on the website, different HTP requests, different form
submissions and all of that.
It is a good skill to know how to read different locks, and it's rather easy.
Most of the time.
So let's take a look at this quick example right here.
So if we click on insufficient logging and monitoring, which is task 30.
I advise you to read through this to get a better grasp as to what this actually is, and now we're
going to download the task file so there is not a virtual machine that we must start here.
We are downloading files in this specific case.
It is a file login.
But let's click on Say.
And while that is downloading, let's go down to check out what are our challenges.
So the first question is, what IP address is the attacker using and the second question is what kind
of attack is being carried out?
Let's go to our file, let's open it double click login, and it will open this small loks file.
By the first look, I can already see that it is a part of a log file from different users trying to
get access on our website at logging directory, so they're most likely trying to log in with username
and password.
We have two hundred code, OK, four first six users, and that means that they successfully logged
in to the page.
This is most likely their usernames right here.
And this is the time when they performed the login request here.
We also have their IP address.
So what is of right here?
Well, these four or one requests that say unauthorized do look suspicious.
Of course, it can be different users that mistype their passwords so they got unauthorized error.
But we will notice that it's all coming from the same IP address.
So all four requests are coming from the same IP address.
With different usernames, this could point to a brute force attack, for example, we can also see
that the user is trying to authenticate as the admin.
So that is also suspicious.
So we can conclude that this user right here is trying to perform a brute force attack, for example.
Let's answer the first question, what IP address is the attacker using, so let's copy the IP address.
Like this specified right here and for some reason it won't copy, so let's just type it for nine nine
nine one three one six.
Let's click on Submit, and that is the correct answer.
What kind of attack is being carried out?
Well, we already mentioned that it's most likely a brute force attack.
SLED specified that right here.
Click on Submit.
And that's also the correct answer.
So this was a quick example of how to read logs and how to find something that might look suspicious.
Nonetheless, let's move on to the next lecture where we are going to cover how can we monetize fogbound
skills that we learned throughout this course?