Tag Info

New answers tagged

0

Except for the log cleaning the other answers mentioned, there shouldn't be any danger from having a writable log file. A readable log file on the other hand can lead to log poisoning, which can turn a local file inclusion into a code execution vulnerability. The attack might look like this: An attacker visits example.com/<?php // code you want to ...


2

Servers need to save their activities and performance on specific files. ErrorLog is the file where Apache saves its errors defined by their name and location. So by understadning the role of this file you can guess that only the server itself must be allowed to write on this file otherwise miscreants will write anything else to mislead you to take actions ...


4

Log files are often used to detect suspicious activities, like attacks. But, if the log file can be modified by the attacker itself, (s)he can clean up the logs after the attack or plant false information which confuse the after-attack analysis.


-2

I saw the CISO of Mandiant speak recently, he said when he is asked if there was always a pattern of behaviour that distinguishes an attacker (malware) from valid activity, he replies that if the attacker behaved exactly the same as valid worker we should thank them for doing work for free for us. Clearly the attacker will behave differently in some way from ...


4

If you have an Apache web server with a standard configuration, and a cgi scripts that makes use of bash, the log entry for a request may look identical in the following three cases: A legitimate request is made. A successful attack is performed. An attempted attack fails because you have upgraded to a bash version that disables the vulnerable feature. ...


14

This is an entry from my access_log of what my coworker did to my test machine... : 10.11.12.13 - - [25/Sep/2014:16:00:00 -0400] "GET /cgi-bin/testing.cgi HTTP/1.0" 200 1 "-" "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/rm -rf /var/www/" In my error log I saw a lot of this: [Thu Sep 25 16:00:00 2014] [error] [client 10.11.12.13] ...


6

the most things you could notice at the moment are Probes, scanning random servers for possible attack vectors, so its advised to patch. a possible "attack" or atleast a check could look a bit like this: egrep "};|}\s*;" /var/www/logs/access* xxx.xxx.xxx.xxx - - [25/Sep/2014:12:12:12 +0100] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 168 "-" "() { :;}; ...


0

Googling I came upon this page titled: Snortsam - A Firewall Blocking Agent for Snort which is a plugin for Snort. According to this plugins page it can integrate with Sagan as well: excerpt SnortSam has also been integrated with Sagan, which is a log analysis engine developed by Champ Clark. The Snortsam Output Plugin and related files (header, ...



Top 50 recent answers are included