Unit 5: Web Attacks, Dark Web and Cloud Forensics

I. Orientation: The Investigative Landscape

Digital forensics in this unit spans three environments — web servers, the anonymised dark web, and distributed cloud infrastructure — each demanding evidence acquisition adapted to volatility and jurisdiction. The unifying principle is artifact correlation: reconstructing an attacker's actions by aligning timestamps across logs, network captures, and system state.

• Order of volatility: Collect RAM and network connections before disk; collect disk before archived logs, because volatile data disappears on reboot.
• Chain of custody: Every artifact must be hashed (SHA-256), sealed, and documented from seizure to court to preserve admissibility.
• Locard's exchange principle: Any interaction leaves a trace — an HTTP request writes a log line, a Tor session writes prefetch entries, an AWS API call writes a CloudTrail event.
• Timeline as backbone: All later sections resolve to a single normalised (UTC) timeline of events.

II. Web Server Log Forensics

Reading the server's own record of every request.

A. Understand web application forensics

Web application forensics investigates attacks targeting the application layer by examining server-side evidence.

• Evidence sources: Access logs, error logs, database transaction logs, application logs, and configuration files.
• Goal: Identify the attack vector, the compromised resource, and the attacker's IP/user-agent.
• Server-side vs client-side: Server logs capture requests; browser caches and cookies on the victim add client context.

B. Understand Internet Information Services (IIS) logs

IIS is Microsoft's web server; its logs are the primary artifact on Windows hosts.

• Location: %SystemDrive%\inetpub\logs\LogFiles\W3SVC<siteID>\.
• Format: W3C Extended, space-delimited, with a #Fields: header line.
• Key fields: date time c-ip cs-method cs-uri-stem cs-uri-query sc-status cs(User-Agent).

2026-09-25 21:00:51 192.168.1.10 GET /login.aspx id=1' 500 Mozilla/5.0

• Investigative reading: sc-status 500 plus a quote in cs-uri-query above signals a probable SQL injection probe.

C. Understand Apache web server logs

Apache is the dominant Linux web server; logs are text and highly configurable.

• Access log: /var/log/apache2/access.log (Debian) or /var/log/httpd/access_log (RHEL).
• Common Log Format: %h %l %u %t "%r" %>s %b.

192.168.1.10 - - [25/Sep/2026:21:00:51 +0000] "GET /admin?x=<script> HTTP/1.1" 200 512

• Error log: Records PHP faults and module failures useful for confirming exploitation.
• Symbol key: %h = client host, %t = timestamp, %r = request line, %>s = final status, %b = bytes sent.

III. Detection and Defence Mechanisms

The controls that both block attacks and generate corroborating evidence.

A. Understand the functionality of intrusion detection system (IDS)

An IDS monitors traffic or hosts to flag suspicious activity, producing alert logs that corroborate log evidence.

1. Signature-based: Matches traffic against known-attack patterns (e.g., Snort rules); precise but blind to novel attacks.
2. Anomaly-based: Flags deviation from a learned baseline; catches zero-days but yields more false positives.
   • NIDS vs HIDS: Network IDS inspects packets at a sensor; Host IDS (e.g., OSSEC) watches file integrity and system calls.

B. Understand the functionality of web application firewall (WAF)

A WAF filters HTTP traffic to block application-layer attacks before they reach the server.

• Operation: Inspects request bodies, headers, and parameters against rulesets (e.g., OWASP Core Rule Set).
• Forensic value: WAF logs record blocked payloads and rule IDs, revealing attack attempts even when the exploit failed.
• Placement: Reverse-proxy, in-line, or host-based module (ModSecurity).

IV. Investigating Web Attacks

Turning logged requests into a reconstructed intrusion.

A. Investigate web attacks on windows-based servers

Windows web-attack investigation combines IIS logs with OS-level artifacts.

• Event logs: Security.evtx for logons (Event ID 4624/4625), System.evtx for service changes.
• Web shell hunting: Search inetpub\wwwroot for recently modified .aspx/.asp files.
• Correlation: Match IIS c-ip to failed logons and to firewall records for a full path.

B. Detect and investigate various attacks on web applications

Each web attack leaves a distinctive log signature.

• SQL injection: UNION SELECT, ', or -- in query strings; database errors in logs.
• Cross-site scripting (XSS): <script>, onerror=, or encoded %3Cscript%3E in parameters.
• Directory traversal: ../ or ..%2f sequences targeting /etc/passwd or web.config.
• Command injection: Shell metacharacters ; | & appended to parameters.
• Brute force: Rapid repeated POST /login with 401/403 responses from one IP.
• Worked example — detecting traversal: GET /view?file=../../../../etc/passwd 200 returning a large byte count confirms the file was disclosed.

V. The Dark Web and Tor Forensics

Investigating anonymised networks and the browser that reaches them.

A. Understand the dark web

The dark web is the portion of the deep web reachable only through anonymising overlays like Tor.

• Layers: Surface web (indexed) → deep web (unindexed) → dark web (overlay-only).
• Access: .onion addresses resolved inside the Tor network, not public DNS.
• Onion routing: Traffic is encrypted in layers and relayed through entry, middle, and exit nodes, masking source IPs.

B. Determine how to identify the traces of tor browser during investigation

Even a "privacy" browser leaves residual host artifacts.

• Installation evidence: Tor Browser folder, tor.exe and firefox.exe in the bundle.
• Registry/Prefetch: TOR.EXE-*.pf prefetch files prove execution with timestamps.
• Memory: RAM captures may hold .onion URLs and circuit data since Tor keeps little on disk.

C. Perform Tor browser forensics

Analysis focuses on execution artifacts and volatile memory rather than history.

• state file: In Tor Browser\Browser\TorBrowser\Data\Tor\ records last-run data.
• torrc: Configuration file revealing bridges or custom relays.
• Approach: Acquire RAM first (live URLs, keys), then image disk for prefetch, pagefile, and installer remnants.

VI. Cloud Computing and Cloud Forensics

Adapting investigation to infrastructure you do not physically own.

A. Understand the basic cloud computing concepts

Cloud computing delivers on-demand resources over a network.

• Service models: IaaS (VMs), PaaS (runtime), SaaS (applications).
• Deployment models: Public, private, hybrid, community.
• Traits: Elasticity, multi-tenancy, measured service, broad access.

B. Understand cloud forensics

Cloud forensics applies digital forensics to distributed, provider-controlled environments.

• Shared responsibility: The provider secures infrastructure; the customer owns data and access — this dictates who can collect what.
• Challenges: Volatile instances, data distributed across regions, and jurisdictional/legal barriers to seizure.
• Evidence: Snapshots, API/audit logs, and provider-supplied records under legal process.

VII. Amazon Web Services (AWS) Forensics

Investigating the largest public cloud.

A. Understand the fundamentals of Amazon Web Services (AWS)

AWS provides modular cloud services organised by region and availability zone.

• Core services: EC2 (compute), S3 (object storage), IAM (identity), VPC (networking).
• Identity: IAM users, roles, and policies govern all access.

B. Determine how to investigate security incidents in AWS

Investigation relies on native logging services rather than physical access.

• CloudTrail: Records every API call (who, what, when, from where) — the primary audit trail.
• VPC Flow Logs: Capture network traffic metadata for lateral-movement analysis.
• Acquisition: Take EBS snapshots of a compromised EC2 instance and analyse an isolated copy; check S3 access logs for exfiltration.

VIII. Microsoft Azure Forensics

Investigating Microsoft's cloud platform.

A. Understand the fundamentals of Microsoft Azure

Azure organises resources hierarchically for management and billing.

• Hierarchy: Management group → subscription → resource group → resource.
• Core services: Virtual Machines, Blob Storage, Azure AD (identity), Virtual Network.

B. Determine how to investigate security incidents in Azure

Azure exposes activity and identity logs for reconstruction.

• Activity Log: Control-plane operations (resource create/delete/modify).
• Azure AD sign-in logs: Authentication events, MFA status, and source IPs.
• Acquisition: Snapshot the VM's managed disk; use Microsoft Sentinel/Monitor to query correlated telemetry.

IX. Containers and Microservices Forensics

Investigating ephemeral, orchestrated workloads.

A. Understand forensic methodologies for containers and microservices

Containerised systems are short-lived and distributed, so evidence must be captured live.

• Ephemerality problem: A container may be destroyed and recreated in seconds, erasing on-disk state — capture running state immediately.
• Evidence layers: Container image and layers, orchestrator logs (Kubernetes audit logs), and the host's Docker daemon logs at /var/log.
• Live acquisition: docker commit a suspect container to a forensic image; export logs via docker logs before termination.
• Microservice correlation: Distributed tracing (request IDs across services) reconstructs an attack that traverses many small services.
• Isolation: Cordon the node and preserve volumes rather than deleting pods, so persistent data survives investigation.