Unit 5: Web Attacks, Dark Web and Cloud Forensics - Subjective Questions

Web application forensics is the process of collecting, preserving, analyzing, and documenting digital evidence related to attacks or malicious activities targeting web applications. It focuses on tracing the source, method, and impact of attacks such as SQL injection, cross-site scripting (XSS), and unauthorized access.

Importance:

• Incident reconstruction: Helps reconstruct the sequence of events during an attack.
• Attribution: Assists in identifying the attacker through IP addresses, user agents, and session data.
• Evidence collection: Gathers logs, database records, and server artifacts for legal proceedings.
• Vulnerability identification: Reveals exploited weaknesses so they can be patched.
• Compliance: Supports regulatory requirements (e.g., PCI-DSS, GDPR) for breach investigations.

Key sources of evidence include:

• Web server logs (IIS, Apache)
• Application logs
• Database logs
• Firewall and IDS/IPS logs
• Network packet captures

IIS logs are records generated by Microsoft's Internet Information Services web server that capture details of every HTTP request processed by the server. They are stored by default in %SystemDrive%\inetpub\logs\LogFiles.

Common IIS log fields (W3C Extended format):

• date & time: When the request occurred.
• s-ip: Server IP address.
• cs-method: HTTP method (GET, POST, etc.).
• cs-uri-stem: Requested resource/page.
• cs-uri-query: Query string parameters.
• c-ip: Client (source) IP address.
• cs(User-Agent): Browser/client information.
• sc-status: HTTP status code (e.g., 200, 404, 500).
• sc-substatus & sc-win32-status: Additional error codes.
• time-taken: Duration of request processing.

Significance in investigations:

• Identifies malicious requests (e.g., SQL injection strings in query parameters).
• Reveals attacker IP addresses and user agents.
• Helps detect brute-force attempts through repeated failed requests.
• Tracks file access patterns and abnormal status codes.
• Provides a timeline of attacker activity for correlation.

Apache web server logs record all activity handled by the Apache HTTP server, providing crucial evidence for forensic analysis. The two primary log types are the access log and the error log.

Access Log:

• Location: /var/log/apache2/access.log or /var/log/httpd/access_log
• Records every request made to the server.
• Uses Common Log Format (CLF) or Combined Log Format.
• Fields include: client IP, identity, user ID, timestamp, request line, status code, response size, referer, and user-agent.
• Example: 192.168.1.10 - - [25/Sep/2026:10:15:32 +0000] "GET /index.html HTTP/1.1" 200 1043

Error Log:

• Location: /var/log/apache2/error.log or /var/log/httpd/error_log
• Records server errors, warnings, and diagnostic messages.
• Captures issues like failed authentication, missing files, and script errors.

Distinction:

An Intrusion Detection System (IDS) is a security tool that monitors network or system activities for malicious actions or policy violations and generates alerts when suspicious behavior is detected.

Functionality:

• Monitoring: Continuously inspects network traffic or system logs.
• Detection: Identifies threats using signatures or anomaly-based analysis.
• Alerting: Notifies administrators of potential intrusions.
• Logging: Records incidents for later forensic analysis.

Types of IDS:

1. Network-based IDS (NIDS): Monitors traffic across the entire network segment (e.g., Snort).
2. Host-based IDS (HIDS): Monitors a single host's system files, logs, and processes (e.g., OSSEC).

Detection methods:

• Signature-based detection: Matches known attack patterns; effective against known threats but not zero-days.
• Anomaly-based detection: Establishes a baseline of normal behavior and flags deviations; can detect unknown attacks but may produce false positives.

Forensic value: IDS logs provide timestamps, source/destination IPs, and attack signatures that help reconstruct attack timelines.

A Web Application Firewall (WAF) is a security solution that filters, monitors, and blocks HTTP/HTTPS traffic between a web application and the Internet. It operates at the application layer (Layer 7) of the OSI model.

How it protects web applications:

• Traffic inspection: Analyzes incoming requests for malicious payloads.
• Attack prevention: Blocks common attacks such as:
  • SQL injection
  • Cross-site scripting (XSS)
  • Cross-site request forgery (CSRF)
  • File inclusion attacks
• Rule-based filtering: Uses predefined and custom rules (e.g., OWASP Core Rule Set).
• Rate limiting: Prevents DDoS and brute-force attacks.

Deployment models:

1. Network-based WAF: Hardware appliance, low latency but costly.
2. Host-based WAF: Integrated into application software, highly customizable.
3. Cloud-based WAF: Delivered as a service (e.g., AWS WAF, Cloudflare), easy to deploy and scalable.

Forensic value: WAF logs capture blocked requests, attack signatures, and source IPs, aiding in the investigation of attempted intrusions.

Investigating web attacks on Windows-based servers (typically running IIS) involves a systematic approach to collect and analyze evidence.

Investigation steps:

1. Identify the incident: Determine the type of attack (defacement, injection, unauthorized access).
2. Preserve evidence: Create forensic images of affected systems and preserve volatile data.
3. Analyze IIS logs: Located at %SystemDrive%\inetpub\logs\LogFiles. Look for:
   • Suspicious query strings (SQLi, XSS payloads)
   • Abnormal HTTP status codes
   • Repeated requests from single IPs (brute-force)
4. Examine Windows Event Logs: Check Security, System, and Application logs using Event Viewer.
5. Inspect the file system: Identify uploaded web shells, modified pages, and suspicious executables.
6. Analyze the registry: Look for persistence mechanisms.
7. Review network artifacts: Firewall and IDS logs, netstat connections.
8. Correlate timelines: Combine evidence from multiple sources to reconstruct the attack.
9. Document findings: Maintain chain of custody and prepare a report.

Tools used: Log Parser, Event Viewer, FTK Imager, Wireshark, and PowerShell.

SQL Injection (SQLi) and Cross-Site Scripting (XSS) are among the most common web application attacks. Detecting them requires analyzing logs and application behavior.

SQL Injection Detection & Investigation:

• Log indicators: Look for SQL keywords in query strings such as ' OR 1=1--, UNION SELECT, DROP TABLE, and encoded variants.
• Behavioral signs: Database errors, unusual query response times, unexpected data exposure.
• Investigation:
  • Examine web server logs (cs-uri-query) for malicious patterns.
  • Review database logs for anomalous queries.
  • Identify the source IP and affected parameters.

XSS Detection & Investigation:

• Log indicators: Presence of <script>, javascript:, onerror=, alert(), and URL-encoded tags like %3Cscript%3E.
• Types: Reflected, Stored, and DOM-based XSS.
• Investigation:
  • Search access logs for injected script tags.
  • Identify stored payloads in the database (for stored XSS).
  • Trace victim sessions and cookie theft attempts.

Preventive correlation: Cross-reference WAF and IDS alerts with server logs to confirm exploitation and identify the attacker.

The Dark Web is a portion of the Internet that is intentionally hidden and inaccessible through standard browsers, requiring special software like the Tor browser to access. It is often associated with anonymity and illicit activities.

Comparison of Web layers:

Key points:

• The Surface Web is only a small fraction (~4%) of the Internet.
• The Deep Web includes legitimate private content requiring authentication.
• The Dark Web uses onion routing to anonymize both users and servers, making it useful for privacy but also exploited for illegal trade, forums, and communications.

Identifying traces of the Tor browser is important because criminals often use it for anonymity. Even though Tor is designed to leave minimal traces, several artifacts can reveal its usage.

Key traces and indicators:

• Installation artifacts:
  • Presence of Tor Browser folder on the system or removable media.
  • firefox.exe within the Tor Browser directory.
• Registry artifacts (Windows):
  • Prefetch files (.pf) indicating Tor execution, e.g., TOR.EXE-XXXXXX.pf.
  • Registry keys under NTUSER.DAT and shellbags.
• Memory analysis:
  • RAM may contain .onion URLs, browsing artifacts, and encryption keys.
• Network artifacts:
  • Connections to known Tor entry/guard nodes.
  • Traffic to ports 9001, 9030, 9050, 9150.
• File system artifacts:
  • state, torrc, and lock files in the Tor data directory.
  • Thumbnail cache and jump lists.

Forensic approach: Analyze RAM captures using tools like Volatility, examine prefetch and registry files, and inspect network logs for Tor node connections.

Tor browser forensics involves examining a system to determine whether the Tor browser was used and to recover any recoverable browsing artifacts.

Forensic process:

1. Acquisition:
   • Create a forensic image of the disk and capture volatile memory (RAM), as Tor stores much data in memory.
2. Memory Analysis:
   • Use Volatility to extract .onion URLs, processes, and network connections.
   • Search memory strings for Tor-related keywords and browsing history.
3. Disk Analysis:
   • Search for the Tor Browser directory and its files (torrc, state, Tor Browser folder).
   • Analyze Prefetch files for evidence of execution.
   • Examine NTUSER.DAT registry hive for MRU lists and shellbags.
4. Artifact recovery:
   • Recover deleted Tor files from unallocated space.
   • Analyze thumbnail caches and jump lists.
5. Network analysis:
   • Review packet captures/firewall logs for connections to Tor nodes.
6. Documentation:
   • Maintain chain of custody and document all findings.

Challenges: Tor uses encryption and stores minimal data on disk, so live memory acquisition before shutdown is critical for successful investigation.

Cloud computing is the on-demand delivery of computing resources—servers, storage, databases, networking, and software—over the Internet with pay-as-you-go pricing.

Essential characteristics (NIST):

• On-demand self-service
• Broad network access
• Resource pooling
• Rapid elasticity
• Measured service

Service Models:

1. IaaS (Infrastructure as a Service): Provides virtualized computing resources (e.g., AWS EC2, Azure VMs).
2. PaaS (Platform as a Service): Provides platforms for developing and deploying applications (e.g., Google App Engine).
3. SaaS (Software as a Service): Delivers software over the Internet (e.g., Gmail, Office 365).

Deployment Models:

1. Public Cloud: Services offered over the public Internet (AWS, Azure).
2. Private Cloud: Dedicated to a single organization.
3. Hybrid Cloud: Combination of public and private clouds.
4. Community Cloud: Shared by organizations with common concerns.

Benefits: Scalability, cost efficiency, flexibility, and reliability.

Cloud forensics is the application of digital forensic principles and procedures to cloud computing environments to investigate crimes and security incidents involving cloud resources. It is a subset of network forensics.

Dimensions of cloud forensics:

• Technical: Tools and procedures for data acquisition and analysis.
• Organizational: Roles of cloud service providers (CSPs) and consumers.
• Legal: Multi-jurisdictional laws and service level agreements (SLAs).

Challenges:

• Data location: Data may be distributed across multiple geographic regions and jurisdictions.
• Multi-tenancy: Multiple customers share the same physical resources, risking data commingling.
• Volatility: Virtual machines and data can be quickly deleted or moved.
• Dependence on CSP: Investigators often rely on the provider for evidence access.
• Chain of custody: Difficult to maintain across distributed environments.
• Lack of physical access: Investigators cannot physically seize hardware.
• Limited logs: Log availability depends on the service model and provider.

Mitigation: Well-defined SLAs, cooperation with CSPs, and use of cloud-native logging (e.g., AWS CloudTrail, Azure Monitor).

Amazon Web Services (AWS) is a comprehensive cloud computing platform offered by Amazon, providing on-demand infrastructure, storage, databases, and analytics services.

Core AWS services:

• EC2 (Elastic Compute Cloud): Scalable virtual servers.
• S3 (Simple Storage Service): Object storage for data.
• RDS (Relational Database Service): Managed databases.
• VPC (Virtual Private Cloud): Isolated network environments.
• IAM (Identity and Access Management): Controls user access and permissions.

Services relevant to forensics:

• AWS CloudTrail: Records API calls and account activity — a primary source of forensic evidence.
• Amazon CloudWatch: Monitors resources and collects logs/metrics.
• VPC Flow Logs: Captures network traffic information.
• AWS Config: Tracks configuration changes over time.
• GuardDuty: Threat detection service.

Forensic significance: These logging and monitoring services provide timestamps, user identities, IP addresses, and event details essential for reconstructing security incidents in AWS.

Investigating security incidents in AWS requires leveraging cloud-native logging and monitoring tools to collect and analyze evidence.

Investigation process:

1. Incident identification: Detect anomalies via GuardDuty, CloudWatch alarms, or user reports.
2. Preserve evidence:
   • Take EBS snapshots of affected volumes.
   • Create AMIs of compromised instances.
   • Isolate instances using security groups.
3. Analyze CloudTrail logs: Review API activity for:
   • Unauthorized access
   • IAM privilege escalation
   • Resource creation/deletion
4. Examine VPC Flow Logs: Identify suspicious network traffic and connections.
5. Review CloudWatch logs: Analyze application and system metrics.
6. Check IAM configurations: Look for compromised credentials and unusual role assumptions.
7. Analyze S3 access logs: Detect data exfiltration attempts.
8. Timeline reconstruction: Correlate events across services.
9. Containment and remediation: Revoke credentials, patch vulnerabilities.
10. Documentation: Maintain chain of custody and prepare a report.

Key tools: CloudTrail, GuardDuty, VPC Flow Logs, AWS Config, and CloudWatch.

Microsoft Azure is a cloud computing platform by Microsoft offering IaaS, PaaS, and SaaS services for building, deploying, and managing applications.

Core Azure services:

• Azure Virtual Machines: Scalable compute instances.
• Azure Blob Storage: Object storage for unstructured data.
• Azure SQL Database: Managed relational database.
• Azure Virtual Network (VNet): Isolated networking.
• Azure Active Directory (Azure AD): Identity and access management.

Services useful for forensics:

• Azure Monitor: Collects and analyzes telemetry data.
• Azure Activity Log: Records subscription-level events (equivalent to CloudTrail).
• Azure Sentinel: Cloud-native SIEM for threat detection and investigation.
• Network Watcher: Provides network diagnostic and logging tools (NSG flow logs).
• Azure Security Center / Defender: Security posture management and alerts.

Forensic significance: These services capture user activities, resource changes, network flows, and security alerts, providing essential evidence for reconstructing incidents in Azure environments.

Investigating security incidents in Microsoft Azure involves using Azure's built-in logging, monitoring, and security tools.

Investigation process:

1. Detection: Identify incidents via Azure Security Center alerts, Azure Sentinel, or user reports.
2. Preserve evidence:
   • Capture VM disk snapshots of affected machines.
   • Isolate compromised VMs using Network Security Groups (NSGs).
3. Analyze Azure Activity Logs: Review subscription-level operations for:
   • Unauthorized resource changes
   • Suspicious role assignments
   • Deletion of resources
4. Examine Azure AD sign-in logs: Detect brute-force attempts, impossible travel, and compromised accounts.
5. Review NSG Flow Logs (Network Watcher): Identify malicious network traffic.
6. Use Azure Sentinel: Correlate events and run threat-hunting queries (KQL).
7. Analyze storage logs: Detect data exfiltration from Blob storage.
8. Timeline reconstruction: Combine logs to establish the sequence of events.
9. Remediation: Reset credentials, revoke tokens, patch vulnerabilities.
10. Documentation: Maintain chain of custody and report findings.

Key tools: Azure Monitor, Activity Log, Azure AD logs, Sentinel, and Network Watcher.

Containers (e.g., Docker) and microservices architectures present unique forensic challenges due to their ephemeral, distributed, and scalable nature.

Forensic challenges:

• Ephemeral nature: Containers are short-lived and may be destroyed quickly.
• Immutability: Container images are read-only, and changes occur in writable layers.
• Distributed architecture: Microservices span multiple hosts and services.
• Orchestration complexity: Tools like Kubernetes add layers of abstraction.

Forensic methodology:

1. Evidence acquisition:
   • Capture container images and writable layers.
   • Snapshot the host system and container runtime state.
   • Collect container logs (docker logs) and orchestration logs (Kubernetes audit logs).
2. Memory analysis: Capture container and host memory for volatile data.
3. Image analysis: Inspect layers for malicious code or backdoors.
4. Network analysis: Examine inter-service communication and service mesh logs.
5. Configuration review: Analyze Dockerfiles, Kubernetes manifests, and secrets.
6. Timeline reconstruction: Correlate logs across services.

Best practices:

• Enable centralized logging and audit trails.
• Use immutable infrastructure and image signing.
• Preserve containers before deletion using snapshots.

Tools: Docker Forensics Toolkit, Sysdig, Falco, and Kubernetes audit logs.

Both IDS and WAF are security controls, but they serve different purposes and operate at different levels.

Comparison:

Forensic value:

• IDS logs: Provide alerts, timestamps, source/destination IPs, and attack signatures useful for detecting broad network intrusions.
• WAF logs: Capture blocked HTTP requests, malicious payloads, and attacker patterns specific to web applications.

Conclusion: IDS offers broad detection, while WAF provides focused prevention at the application layer. Together they provide layered defense and complementary forensic evidence.

Onion routing is the technique used by the Tor network to provide anonymity by encrypting and routing traffic through multiple relays.

How onion routing works:

1. Circuit creation: The Tor client selects a path of three relays — an entry (guard) node, a middle node, and an exit node.
2. Layered encryption: Data is encrypted in multiple layers (like an onion), one for each relay.
3. Relaying: Each node decrypts one layer to reveal the next hop, without knowing the full path.
   • The entry node knows the source but not the destination.
   • The exit node knows the destination but not the source.
4. Exit: The exit node forwards decrypted traffic to the destination server.

Challenges for investigators:

• Anonymity: No single node knows both source and destination.
• Encryption: Traffic is encrypted at multiple layers.
• No central logging: Relays are volunteer-operated worldwide, spanning jurisdictions.
• Hidden services: .onion sites hide the server location.
• Minimal local traces: Tor leaves little data on the user's disk.

Forensic approach: Focus on endpoint analysis (memory captures, prefetch, registry) and correlation attacks rather than tracing network traffic, since the network itself is designed to resist tracking.

The shared responsibility model defines the division of security and forensic responsibilities between the Cloud Service Provider (CSP) and the customer. It varies with the service model.

Responsibility distribution:

General principle:

• The CSP is responsible for the security of the cloud (hardware, infrastructure, hypervisor).
• The customer is responsible for the security in the cloud (data, applications, access management).

Impact on evidence collection:

• Access limitations: Customers can only collect evidence from layers they control; deeper artifacts (hypervisor, physical logs) require CSP cooperation.
• Dependence on CSP: Investigators must request logs and data from the provider, often governed by SLAs.
• Jurisdiction issues: CSP-controlled data may reside in different legal regions.
• Log availability: In SaaS, customers have minimal access to underlying logs, limiting forensic depth.

Conclusion: Understanding the shared responsibility model is essential to determine which evidence is accessible directly versus which requires provider involvement, shaping the entire investigation strategy.