Network Analysis

Task: As a SOC analyst at BookWorld, an online bookstore, you detect an unusual spike in database queries and server resource usage, triggering an automated alert. Concerned about potential malicious activity, you must analyze network traffic to identify the attack vector, assess a possible data breach, and determine if the attacker gained deeper access to internal systems.

Q1) What is the attacker's IP?

We can obtain this information using the Statistics tab in Wireshark.

Let's verify whether this IP address belongs to the attacker.

ip.addr==111.224.250.131

We can also obtain this information using TShark.

tshark -r PCAP3.pcap -z endpoints,ip -q

Answer: 111.224.250.131

Q2) Determine the original city of the attacker.

From this website: https://ipgeolocation.io/

Answer: Shijiazhuang

Q3) Can you provide the vulnerable PHP script name?

http.request.uri contains ".php"

Let's direct our attention to the search.php page.

http.request.uri contains "search.php"

The attacker is attempting to perform an SQL Injection on this page.

Using Tshark:

tshark -r PCAP3.pcap -Y 'http.request.uri contains "search.php"' -T fields -e http.request.uri | sort | uniq

Answer: search.php

Q4) What's the complete request URI of the first SQLi attempt by the attacker?

http.request.uri contains "search.php"

Answer: https://bookworldstore.com/search.php?search=book%20and%201=1;%20--%20-

Q5) Can you provide the complete request URI that was used to read the web server's available databases?

Let's use Ctrl + F to search for the term "Information_schema" within the packet data.

We've received some hits. Let's analyze each one by following its TCP stream to gather relevant information.

Using Tshark:

First, we need to identify the frame number of the packets containing information_schema.

tshark -r PCAP3.pcap -Y "http.request" -T fields -e http.request.uri -e tcp.stream | grep -Ei "information_schema"

Next, we will analyze the TCP stream for each connection individually.

tshark -r PCAP3.pcap -z follow,http,ascii,151 -q

Answer: https://bookworldstore.com/search.php?search=book%27%20UNION%20ALL%20SELECT%20NULL%2CCONCAT%280x7178766271%2CJSON_ARRAYAGG%28CONCAT_WS%280x7a76676a636b%2Cschema_name%29%29%2C0x7176706a71%29%20FROM%20INFORMATION_SCHEMA.SCHEMATA--%20-

Q6) What's the table name containing the website users' data?

http.request.uri contains "search.php"

Let's use Ctrl + F to search for the term "Information_schema" within the packet data.

Using Tshark:

tshark -r PCAP3.pcap -z follow,http,ascii,154 -q

Answer: cutomers

Q7) What's the name of the directory discovered by the attacker?

http.request.method == POST

Answer: /admin

Q8) What are the credentials used by the attacker for logging in?

Let's analyze the HTTP stream associated with the fourth packet in this capture.

http.request.method == POST

Answer: admin:admin123!

Q9) What's the name of the malicious script uploaded by the attacker?

http.request.method == POST

Let's analyze the HTTP stream associated with the fifth packet.

Answer: NVri2vhp.php