1
00:00:00,060 --> 00:00:01,020
In this lesson,

2
00:00:01,020 --> 00:00:03,510
we're going to talk about firewall logs.

3
00:00:03,510 --> 00:00:05,010
Now in this lesson, I want to go ahead

4
00:00:05,010 --> 00:00:07,740
and show you two examples of firewall logs.

5
00:00:07,740 --> 00:00:10,080
The first one is going to be a standard firewall log,

6
00:00:10,080 --> 00:00:11,160
and the second one is going

7
00:00:11,160 --> 00:00:13,440
to be a web application firewall log.

8
00:00:13,440 --> 00:00:15,120
Let's take a look at these and see if we can figure out

9
00:00:15,120 --> 00:00:17,400
what kind of malicious activity might be occurring

10
00:00:17,400 --> 00:00:19,500
inside of these firewall snippets.

11
00:00:19,500 --> 00:00:22,560
Now the first one we have is going to be our basic firewall,

12
00:00:22,560 --> 00:00:24,900
and this one's operating as a layer four firewall.

13
00:00:24,900 --> 00:00:27,000
So we're going to get some really basic information here,

14
00:00:27,000 --> 00:00:29,910
including the date, the time, the source IP address,

15
00:00:29,910 --> 00:00:32,369
the destination IP address, the source port,

16
00:00:32,369 --> 00:00:34,920
the destination port, the protocol being used,

17
00:00:34,920 --> 00:00:36,150
and the action.

18
00:00:36,150 --> 00:00:38,520
In this case, I'm only showing you the blocked actions,

19
00:00:38,520 --> 00:00:40,680
so we can look through this very quickly inside of these

20
00:00:40,680 --> 00:00:43,680
10 or 15 lines and figure out exactly what is happening

21
00:00:43,680 --> 00:00:45,840
and what was being blocked by this firewall.

22
00:00:45,840 --> 00:00:47,370
Now as we look at this, we can see that

23
00:00:47,370 --> 00:00:48,930
all of the sources are the same.

24
00:00:48,930 --> 00:00:52,980
They're all coming from 185.76.9.23

25
00:00:52,980 --> 00:00:55,260
and they're all going to our internal server

26
00:00:55,260 --> 00:00:59,250
located at 192.168.1.105.

27
00:00:59,250 --> 00:01:01,650
Now we see that every single one of these was blocked.

28
00:01:01,650 --> 00:01:03,000
As we look at the source port,

29
00:01:03,000 --> 00:01:05,069
we're seeing it is a random high number port,

30
00:01:05,069 --> 00:01:09,990
like 54,321, 54,322.

31
00:01:09,990 --> 00:01:12,360
And it keeps incrementing up one each time.

32
00:01:12,360 --> 00:01:14,940
Thinking back to the way networks work, you should recognize

33
00:01:14,940 --> 00:01:17,040
that these high number ports are what are being chosen

34
00:01:17,040 --> 00:01:19,410
by the operating system when they're making an outbound

35
00:01:19,410 --> 00:01:21,060
connection to a remote server.

36
00:01:21,060 --> 00:01:22,020
So this makes sense.

37
00:01:22,020 --> 00:01:27,020
The source of 185.76.9.23 is opening a port at 54321

38
00:01:28,206 --> 00:01:31,440
and then it's going outward to the destination IP

39
00:01:31,440 --> 00:01:34,027
of 192.168.1.105,

40
00:01:34,027 --> 00:01:37,140
and the first port it tries is port 22.

41
00:01:37,140 --> 00:01:39,480
That was blocked, so then they tried port 80.

42
00:01:39,480 --> 00:01:40,440
That was blocked.

43
00:01:40,440 --> 00:01:43,110
Then they tried port 443 and that was blocked.

44
00:01:43,110 --> 00:01:45,480
Then they tried port 8080 and that was blocked.

45
00:01:45,480 --> 00:01:47,160
And they keep trying different ports

46
00:01:47,160 --> 00:01:48,810
and each one is being blocked.

47
00:01:48,810 --> 00:01:50,370
So what does this look like to you?

48
00:01:50,370 --> 00:01:52,650
Well, to me, this looks like a port scan,

49
00:01:52,650 --> 00:01:55,350
and our firewall is appropriately identifying that

50
00:01:55,350 --> 00:01:57,660
and blocking it because all these ports are ones

51
00:01:57,660 --> 00:01:59,040
that are closed to the outside world

52
00:01:59,040 --> 00:02:00,510
on this particular network.

53
00:02:00,510 --> 00:02:01,950
Because we don't want anybody going in

54
00:02:01,950 --> 00:02:04,860
and remotely accessing our servers using port 22

55
00:02:04,860 --> 00:02:07,590
or trying to reach into our server over a web port

56
00:02:07,590 --> 00:02:11,730
like port 80 or port 443 because this is not a web server.

57
00:02:11,730 --> 00:02:16,110
So in this case, this server located at 192.168.1.105

58
00:02:16,110 --> 00:02:17,550
is not running any of these services

59
00:02:17,550 --> 00:02:19,230
or any of these ports, so therefore,

60
00:02:19,230 --> 00:02:20,850
it is being blocked by the firewall

61
00:02:20,850 --> 00:02:22,830
to protect that server from any external

62
00:02:22,830 --> 00:02:25,020
connections outside of our network.

63
00:02:25,020 --> 00:02:27,480
Let's go ahead and look at our second firewall log.

64
00:02:27,480 --> 00:02:30,060
Now, this log snippet is coming from a web application

65
00:02:30,060 --> 00:02:32,700
firewall that's going to be operating using deep packet

66
00:02:32,700 --> 00:02:35,460
inspection to look at the contents of what's being asked.

67
00:02:35,460 --> 00:02:36,293
Because of that,

68
00:02:36,293 --> 00:02:38,280
the format will look a little bit different.

69
00:02:38,280 --> 00:02:40,320
Here you can see the time, the source IP,

70
00:02:40,320 --> 00:02:41,850
and the destination IP.

71
00:02:41,850 --> 00:02:43,710
Now we don't really care about the port number in this case

72
00:02:43,710 --> 00:02:45,990
because we're already operating over a port

73
00:02:45,990 --> 00:02:48,120
that we can use this application on,

74
00:02:48,120 --> 00:02:49,290
and in this case we see

75
00:02:49,290 --> 00:02:51,330
that this looks like it's a web server.

76
00:02:51,330 --> 00:02:55,176
So we have a web server at 192.168.10.50

77
00:02:55,176 --> 00:02:57,690
being connected to by a source IP,

78
00:02:57,690 --> 00:03:02,690
which is our remote attacker, at 58.33.123.101.

79
00:03:02,880 --> 00:03:04,650
You'll see it's using a GET method,

80
00:03:04,650 --> 00:03:07,500
and the URI or web address that's being accessed

81
00:03:07,500 --> 00:03:09,450
is everything after that slash.

82
00:03:09,450 --> 00:03:14,450
So the first one is /index.php?id=1.

83
00:03:14,610 --> 00:03:19,610
The second one is /index.php?id='OR '1'='1' --.

84
00:03:24,195 --> 00:03:26,910
And you can see as we go through all of the different things

85
00:03:26,910 --> 00:03:29,430
that are being asked inside this URI column.

86
00:03:29,430 --> 00:03:31,350
And the next column you see is the status code.

87
00:03:31,350 --> 00:03:33,210
You'll notice there are two different status codes here

88
00:03:33,210 --> 00:03:35,070
being returned from our web server.

89
00:03:35,070 --> 00:03:38,160
The status code of 200 indicates an okay status

90
00:03:38,160 --> 00:03:40,140
and it means the successful is successful.

91
00:03:40,140 --> 00:03:44,640
So in the case of /index.php?id=1,

92
00:03:44,640 --> 00:03:46,500
the web server returned a response,

93
00:03:46,500 --> 00:03:48,750
but the request was blocked by the firewall

94
00:03:48,750 --> 00:03:50,400
and so it intercepted that okay code

95
00:03:50,400 --> 00:03:52,710
and didn't send it back to the end user.

96
00:03:52,710 --> 00:03:54,780
The second one had a code of 403,

97
00:03:54,780 --> 00:03:57,090
which is what we call a forbidden status code,

98
00:03:57,090 --> 00:03:59,310
and this indicates that the server understood the request,

99
00:03:59,310 --> 00:04:01,500
but it refuses to authorize it.

100
00:04:01,500 --> 00:04:02,640
Now, that's a good thing here

101
00:04:02,640 --> 00:04:05,010
because our web application firewall is going to block

102
00:04:05,010 --> 00:04:07,860
that request because we can see one equals one in there,

103
00:04:07,860 --> 00:04:10,470
and that means this is an SQL injection.

104
00:04:10,470 --> 00:04:13,590
The next one we have is what we see login.php,

105
00:04:13,590 --> 00:04:15,330
and we see login.php.

106
00:04:15,330 --> 00:04:17,640
The third entry, we have a post command being used

107
00:04:17,640 --> 00:04:19,589
and we're going to login.php.

108
00:04:19,589 --> 00:04:24,360
The fourth one is a GET command and we're using search?q='

109
00:04:24,360 --> 00:04:26,820
and then we see something that says DROP TABLE users.

110
00:04:26,820 --> 00:04:28,020
And what that's telling us is

111
00:04:28,020 --> 00:04:30,690
they're trying to actually drop your SQL table.

112
00:04:30,690 --> 00:04:32,790
And this is actually a big issue for us.

113
00:04:32,790 --> 00:04:34,646
This is actually a destructive SQL command

114
00:04:34,646 --> 00:04:36,480
that was going to delete the table,

115
00:04:36,480 --> 00:04:39,480
and luckily it was blocked by our web application firewall.

116
00:04:39,480 --> 00:04:41,970
The next one we have is going to be on line five,

117
00:04:41,970 --> 00:04:44,910
and line five shows us there's a wait delay going on.

118
00:04:44,910 --> 00:04:46,020
Now what does that mean?

119
00:04:46,020 --> 00:04:48,720
Well, this is showing a time-based SQL injection

120
00:04:48,720 --> 00:04:50,610
where the attackers try to cause a delay

121
00:04:50,610 --> 00:04:53,010
indicating a time-based blind SQL injection

122
00:04:53,010 --> 00:04:55,170
if the page response is being delayed.

123
00:04:55,170 --> 00:04:56,370
And the last one we have

124
00:04:57,277 --> 00:05:02,100
where we have page?id=1 AND SELECT COUNT * from sysusers

125
00:05:02,100 --> 00:05:04,890
is actually trying to gather information about the database

126
00:05:04,890 --> 00:05:07,020
by injecting an SQL command into it

127
00:05:07,020 --> 00:05:09,690
and counting the entry in the database system tables.

128
00:05:09,690 --> 00:05:11,580
Now, do I expect you to know every single one

129
00:05:11,580 --> 00:05:13,110
of these lines and what they mean?

130
00:05:13,110 --> 00:05:16,500
No, but by looking at it, you should see any of these lines

131
00:05:16,500 --> 00:05:19,110
and realize that this is an SQL injection

132
00:05:19,110 --> 00:05:22,350
because of the one equals one, because of the ID equals one,

133
00:05:22,350 --> 00:05:23,820
because of the drop tables,

134
00:05:23,820 --> 00:05:26,340
or the select count from sysusers.

135
00:05:26,340 --> 00:05:28,710
Now on the exam, the most common SQL injection

136
00:05:28,710 --> 00:05:30,990
you're going to see is something equals something.

137
00:05:30,990 --> 00:05:33,180
But if you see some of these other SQL terms

138
00:05:33,180 --> 00:05:35,845
like select or drop, these are things

139
00:05:35,845 --> 00:05:39,360
that should also clue you into an SQL injection going on.

140
00:05:39,360 --> 00:05:41,850
Now, as I said, as you go through these firewall logs,

141
00:05:41,850 --> 00:05:44,370
you may get ones that look like the first firewall log

142
00:05:44,370 --> 00:05:46,470
I showed you, which is a layer four firewall

143
00:05:46,470 --> 00:05:48,480
that's operating based on ports and protocols.

144
00:05:48,480 --> 00:05:50,626
Or you may get a web application firewall,

145
00:05:50,626 --> 00:05:52,920
which is going to be operating at layer seven,

146
00:05:52,920 --> 00:05:55,260
the application layer, and it's going to look more like the one

147
00:05:55,260 --> 00:05:57,965
you see here where you have commands like SQL commands

148
00:05:57,965 --> 00:06:00,027
or injection commands for XML

149
00:06:00,027 --> 00:06:03,060
or a file inclusion or something like that.

150
00:06:03,060 --> 00:06:05,220
Keep this in mind on exam day as you're going through

151
00:06:05,220 --> 00:06:08,070
and analyzing any log snippets they give you from a firewall

152
00:06:08,070 --> 00:06:09,753
or a web application firewall.