PCAP and Web Log Forensics [Sans Holiday Hack 2022 - Web Ring]

In these four challenges, I'm given a PCAP and a web log and asked to identify various attacked. I'll find the malicious IP, identify their brute force login attack, their forced browsing / directory brute force attack, and their XXE attack against the IMDS.

SANS Holiday Hack 2022 writeup: https://0xdf.gitlab.io/holidayhack2022/web

☕ Buy Me A Coffee: https://www.buymeacoffee.com/0xdf

#HolidayHack

[00:00] Introduction
[00:24] Challenge Descriptions
[00:46] Statistics - Conversations
[02:46] Statistics - Protocol Hierarchy
[03:12] Form data POST requests
[04:24] Adding TCP stream and Host columns to Wireshark
[05:40] Looking to see if brute force is successful
[06:46] Looking at Cookie in JWT.io
[07:29] Doing similar analysis on web logs
[10:00] Answering first two questions
[10:18] Third question, solving with web logs
[10:47] Fourth question background, XXE and IMDS
[11:42] Looking at POSTs to /proc
[12:57] XXE payloads and results
[14:45] Getting URL to solve
[15:17] Wrap-up

Скачать видео