This is about a PHP7.4 based shopping platform (opencart (v3.0)).
For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the admin page was also admin. I know, but the purpose of the dummy was just to check if a certain extensions and other things worked. And the dummy gets uninstalled/reinstalled the whole time. This live test environment is completely sandboxed in a vm/container.
Now I noticed a bunch of strange scripts got injected in to the site. Whenever I opened it up and checked the sources in the browser in developer mode, there were a number (3-4) of different adware scripts. I didn't have time to check each of them individually because I needed to reinstall a fresh copy quickly.
But obviously it is a very vulnerable setup and will hopefully get infected again soon so I can replicate the scenario. I want to understand how to track/trace the infection.
I will be checking specific opencart files/logs (and if needed I will ask about it in the relevant forum).
On security.se, I want to ask which specific server logs should I check to track how this happened. Within the live test vm/container, the opencart app is accessed via Apache24. On the main host, nginx handles connections. The only vector, AFAIK, is the admin login page. So this is probably just automated scripts doing their magic?
Edit/add: The OS is FreeBSD.