intermediate · forensics · 150 points · 0 working it

Reading an Attack in the Logs

An access log captured a probing attempt against a small web app. Find the attacker, the vector, and the moment it worked.

Spot the attacker
```
10.0.0.4 - GET /index.html 200
10.66.0.5 - GET /admin 302
10.66.0.5 - GET /wp-login.php 404
10.66.0.5 - GET /.env 404
10.0.0.4 - GET /about 200
```
One client is probing for admin panels, CMS logins, and dotfiles that do not exist on this site.
Which IP is the attacker?
Hint
The one hitting nonexistent paths.
Sign in to verify this checkpoint.
Find the payload verb
```
10.66.0.5 - POST /login 302
10.66.0.5 - POST /login 302
10.66.0.5 - POST /login 302
```
Repeated submissions against a form endpoint is credential stuffing — the HTTP method used is the checkpoint.
Which HTTP method carries the credential-stuffing attempts?
Hint
The write verb.
Sign in to verify this checkpoint.
When the app broke
```
10.66.0.5 - GET /search?id=1 AND 1=2 500
```
A numeric-looking error status on a modified request is the signature of a query breaking — the status code is the checkpoint.
What status code marked the broken query?
Hint
Internal server ___.
Sign in to verify this checkpoint.