In this lesson,
we're going to talk about firewall logs.
Now in this lesson, I want to go ahead
and show you two examples of firewall logs.
The first one is going to be a standard firewall log,
and the second one is going
to be a web application firewall log.
Let's take a look at these and see if we can figure out
what kind of malicious activity might be occurring
inside of these firewall snippets.
Now the first one we have is going to be our basic firewall,
and this one's operating as a layer four firewall.
So we're going to get some really basic information here,
including the date, the time, the source IP address,
the destination IP address, the source port,
the destination port, the protocol being used,
and the action.
In this case, I'm only showing you the blocked actions,
so we can look through this very quickly inside of these
10 or 15 lines and figure out exactly what is happening
and what was being blocked by this firewall.
Now as we look at this, we can see that
all of the sources are the same.
They're all coming from 185.76.9.23
and they're all going to our internal server
located at 192.168.1.105.
Now we see that every single one of these was blocked.
As we look at the source port,
we're seeing it is a random high number port,
like 54,321, 54,322.
And it keeps incrementing up one each time.
Thinking back to the way networks work, you should recognize
that these high number ports are what are being chosen
by the operating system when they're making an outbound
connection to a remote server.
So this makes sense.
The source of 185.76.9.23 is opening a port at 54321
and then it's going outward to the destination IP
of 192.168.1.105,
and the first port it tries is port 22.
That was blocked, so then they tried port 80.
That was blocked.
Then they tried port 443 and that was blocked.
Then they tried port 8080 and that was blocked.
And they keep trying different ports
and each one is being blocked.
So what does this look like to you?
Well, to me, this looks like a port scan,
and our firewall is appropriately identifying that
and blocking it because all these ports are ones
that are closed to the outside world
on this particular network.
Because we don't want anybody going in
and remotely accessing our servers using port 22
or trying to reach into our server over a web port
like port 80 or port 443 because this is not a web server.
So in this case, this server located at 192.168.1.105
is not running any of these services
or any of these ports, so therefore,
it is being blocked by the firewall
to protect that server from any external
connections outside of our network.
Let's go ahead and look at our second firewall log.
Now, this log snippet is coming from a web application
firewall that's going to be operating using deep packet
inspection to look at the contents of what's being asked.
Because of that,
the format will look a little bit different.
Here you can see the time, the source IP,
and the destination IP.
Now we don't really care about the port number in this case
because we're already operating over a port
that we can use this application on,
and in this case we see
that this looks like it's a web server.
So we have a web server at 192.168.10.50
being connected to by a source IP,
which is our remote attacker, at 58.33.123.101.
You'll see it's using a GET method,
and the URI or web address that's being accessed
is everything after that slash.
So the first one is /index.php?id=1.
The second one is /index.php?id='OR '1'='1' --.
And you can see as we go through all of the different things
that are being asked inside this URI column.
And the next column you see is the status code.
You'll notice there are two different status codes here
being returned from our web server.
The status code of 200 indicates an okay status
and it means the successful is successful.
So in the case of /index.php?id=1,
the web server returned a response,
but the request was blocked by the firewall
and so it intercepted that okay code
and didn't send it back to the end user.
The second one had a code of 403,
which is what we call a forbidden status code,
and this indicates that the server understood the request,
but it refuses to authorize it.
Now, that's a good thing here
because our web application firewall is going to block
that request because we can see one equals one in there,
and that means this is an SQL injection.
The next one we have is what we see login.php,
and we see login.php.
The third entry, we have a post command being used
and we're going to login.php.
The fourth one is a GET command and we're using search?q='
and then we see something that says DROP TABLE users.
And what that's telling us is
they're trying to actually drop your SQL table.
And this is actually a big issue for us.
This is actually a destructive SQL command
that was going to delete the table,
and luckily it was blocked by our web application firewall.
The next one we have is going to be on line five,
and line five shows us there's a wait delay going on.
Now what does that mean?
Well, this is showing a time-based SQL injection
where the attackers try to cause a delay
indicating a time-based blind SQL injection
if the page response is being delayed.
And the last one we have
where we have page?id=1 AND SELECT COUNT * from sysusers
is actually trying to gather information about the database
by injecting an SQL command into it
and counting the entry in the database system tables.
Now, do I expect you to know every single one
of these lines and what they mean?
No, but by looking at it, you should see any of these lines
and realize that this is an SQL injection
because of the one equals one, because of the ID equals one,
because of the drop tables,
or the select count from sysusers.
Now on the exam, the most common SQL injection
you're going to see is something equals something.
But if you see some of these other SQL terms
like select or drop, these are things
that should also clue you into an SQL injection going on.
Now, as I said, as you go through these firewall logs,
you may get ones that look like the first firewall log
I showed you, which is a layer four firewall
that's operating based on ports and protocols.
Or you may get a web application firewall,
which is going to be operating at layer seven,
the application layer, and it's going to look more like the one
you see here where you have commands like SQL commands
or injection commands for XML
or a file inclusion or something like that.
Keep this in mind on exam day as you're going through
and analyzing any log snippets they give you from a firewall
or a web application firewall.