Finding forensic evidence for several web attacks

Abstract

Abstract-Symantec Internet Security Threat Report 2014 is showing a horrified fact, that when an attacker looked for a site to compromise, one in eight sites made it relatively easy to gain access. Digital forensics is one of our biggest line of defense against cyber criminals, because it provides evidence against them. For attacks against web applications, web application forensics is the branch which gives most of the answers. First, the victim machine usually gives some data, which are then used for identifying possible suspects, and this is followed by forensic analysis of suspects' devices, like computers, laptops, tablets, and even smart phones. In this paper, we use an attack scenario against the known vulnerable web application WackoPicko, using several web attacks: SQL Injection, stored and reflected XSS, remote file inclusion, and command-line injection. We use post-mortem computer forensic analysis of attacker and victim machine to find some artifacts in them, which can help to identify and possible to reconstruct the attack, and most important, to obtain valid evidence which holds in court. We assume that the attacker was careless and did not perform any antiforensic techniques on its machine.

A hybrid feature-selection approach for finding the digital evidence of webapplication attacks

“…In web application forensics, log files provide detailed events and a trace of security attacks [14]. For this reason, investigators always search for malicious entries in the log files [15,16]. Logs as digital evidence provide extremely useful information that can help in the detection of various kinds of attacks.…”

A four-phase methodology for protecting web applications using an effective real-time technique

“…Web applications typically interact with backend underlying database. Hence, if an unauthorised user gained information by sending a malicious code, then the attacker could obtain illegal access, steal sensitive data of trusted users, and destroy or damage the system (Kindy and Pathan, 2012;Šuteva et al, 2015). This attack can break the trust existing between the users and the server, as well as remove the feature of the absence of input/output validation on the server to reject malicious codes (Baranwal, 2012).…”