CyberDefenders -Web Investigation Lab

Examine network traffic with Wireshark to investigate web server compromise, identify SQL injection, extract attacker credentials, and detect uploaded malware.

Category:

Network Forensics

Tactics:

Initial Access, Persistence, Command and Control

Tools:

Wireshark, Network Miner

Scenario

You are a cybersecurity analyst working in the Security Operations Center (SOC) of BookWorld, an expansive online bookstore renowned for its vast selection of literature. BookWorld prides itself on providing a seamless and secure shopping experience for book enthusiasts around the globe. Recently, you’ve been tasked with reinforcing the company’s cybersecurity posture, monitoring network traffic, and ensuring that the digital environment remains safe from threats.
Late one evening, an automated alert is triggered by an unusual spike in database queries and server resource usage, indicating potential malicious activity. This anomaly raises concerns about the integrity of BookWorld’s customer data and internal systems, prompting an immediate and thorough investigation.
As the lead analyst in this case, you are required to analyze the network traffic to uncover the nature of the suspicious activity. Your objectives include identifying the attack vector, assessing the scope of any potential data breach, and determining if the attacker gained further access to BookWorld’s internal systems.

Question 1) By knowing the attacker’s IP, we can analyze all logs and actions related to that IP and determine the extent of the attack, the duration of the attack, and the techniques used. Can you provide the attacker’s IP?

111.224.250.131
Wireshark display filter
statistics > endpoint > IPV4

Question 2)

If the geographical origin of an IP address is known to be from a region that has no business or expected traffic with our network, this can be an indicator of a targeted attack. Can you determine the origin city of the attacker?

Shijiazhuang

Question 3)

Identifying the exploited script allows security teams to understand exactly which vulnerability was used in the attack. This knowledge is critical for finding the appropriate patch or workaround to close the security gap and prevent future exploitation. Can you provide the vulnerable PHP script name?

search.php
WireShark Display filter
http.request.uri.path == "/search.php"

Question 4)

Get Yufan Limbu’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Establishing the timeline of an attack, starting from the initial exploitation attempt, what is the complete request URI of the first SQLi attempt by the attacker?

/search.php?search=book and 1=1; -- -

decoding the initial payload with urldecode

Question 5)

Can you provide the complete request URI that was used to read the web server’s available databases?

/search.php?search=book' UNION ALL SELECT NULL,CONCAT(0x7178766271,JSON_ARRAYAGG(CONCAT_WS(0x7a76676a636b,schema_name)),0x7176706a71) FROM INFORMATION_SCHEMA.SCHEMATA-- -
WireShark 
tcp stream 151

decoding the payload

Question 6) Assessing the impact of the breach and data access is crucial, including the potential harm to the organization’s reputation. What’s the table name containing the website users data?

customers
WireShark Filters
tcp stream eq 154

Question 7)

The website directories hidden from the public could serve as an unauthorized access point or contain sensitive functionalities not intended for public access. Can you provide the name of the directory discovered by the attacker?

/admin/

Question 8)

Knowing which credentials were used allows us to determine the extent of account compromise. What are the credentials used by the attacker for logging in?

admin:admin123!

Question 9)

We need to determine if the attacker gained further access or control of our web server. What’s the name of the malicious script uploaded by the attacker?

NVri2vhp.php
Wireshark filter dusplay
mime_multipart.header.content-type == "application/x-php"

I successfully completed Web Investigation Blue Team Lab at @CyberDefenders!