Thanks to visit codestin.com
Credit goes to www.scribd.com

Scribd
Upload
96 views2 pages

Module 11 Insufficient Logging and Monitoring Lab: Brought To You by

The document describes a lab activity to test the sufficiency of logging and monitoring on a web server. The steps have a user brute force the login page with Hydra to crack passwords. Upon reviewing the log files in Firefox, the logs do not show the password attack, indicating insufficient monitoring. While other log information is visible, the lack of logs related to the password cracking suggests insufficient logging is in place.

Uploaded by

Taha Khan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
96 views2 pages

Module 11 Insufficient Logging and Monitoring Lab: Brought To You by

The document describes a lab activity to test the sufficiency of logging and monitoring on a web server. The steps have a user brute force the login page with Hydra to crack passwords. Upon reviewing the log files in Firefox, the logs do not show the password attack, indicating insufficient monitoring. While other log information is visible, the lack of logs related to the password cracking suggests insufficient logging is in place.

Uploaded by

Taha Khan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

 

 
 

 
Module 11 Insufficient Logging and Monitoring Lab

Description: In this lab, you will determine if sufficient logging is taking place on the Web
server. We will first run a password attack against the login page and then review the log
files to determine if there is sufficient logging and monitoring in place.
Requirements:​ You will need access to the Cybrary lab environment for this lab.

Step 1:​ Log into Cybrary


Step 2:​ Launch the ​OWASP Insufficient Logging & Monitoring​ lab by searching for it in
the catalog and selecting the launch button
Note: It may take 30-40 seconds for the lab to launch after clicking the button.

Step 3:​ When the lab opens, you will see a pop-up box. Select the Next button, then Ok to
close the pop-up box.
Step 4:​ You will then be taken to the Kali Linux log in screen.
Step 5:​ Enter a username of ​student ​and a password of ​student ​to log into the desktop.
Step 6:​ Next, open a Terminal by clicking the black box on the left-side of the screen.
Step 7:​ At the Terminal prompt, type the following and press Enter. cat login.txt
Note: This shows us parameters for login requests.

Step 8:​ Now, we will brute force the login page with a tool called Hydra.
Step 9:​ Enter the following and press Enter.
hydra -f -l admin -P /usr/share/wordlists/rockyou.txt mutillidae http-post-form
“/mutillidae/index.php?page=login.php:username=^USER^&password=^PASS^&l
ogin-php-submit-button=Login:Password incorrect”

Note: It may take 1 or 2 minutes to perform the attack.

Question 1:​ Do you see any passwords? ____________________________________

 
Brought to you by:  Develop your team with the ​fastest growing catalog​ in the 
cybersecurity industry. Enterprise-grade workforce development 
management, advanced training features and detailed skill gap and 
 
competency analytics. 
1 

 
 
 
 

 
Step 10:​ Next, launch Firefox by clicking on the orange-colored icon on the left-side menu.
Step 11:​ Next, click the ​View Log​ option at the top-right of the page.

Question 2:​ Do you see any log information that shows the password attack we just performed with
Hydra? ________________________________________________

Step 12:​ Keep looking at the log information.

Question 3:​ What else do you see? ______________________________________

Question 4:​ Do you think there is sufficient monitoring going on?


___________________________________________________________________

 
Brought to you by:  Develop your team with the ​fastest growing catalog​ in the 
cybersecurity industry. Enterprise-grade workforce development 
management, advanced training features and detailed skill gap and 
 
competency analytics. 
2 

You might also like