Phase 1: Initial Breach

Using web-security/access.log, answer the following questions to understand how the attacker mapped the server and exploited the application.

Phase 2: Packet Analysis

While your log analysis uncovered some evidence of the attack, you could not see which user was breached or what data was actually stolen. Thankfully, we have network traffic captures from when the attack occurred.

Dive into the web-security/traffic.pcap file to continue your investigation. Keep the attack sequence from Phase 1 in mind!

---

Tips:

• Use the http filter in Wireshark to view only HTTP traffic.
• Right-click on any packet → Follow HTTP Stream to reconstruct the full request and response between the client and server.

Phase 3: Post-Exploitation

Using web-security/access.log2, answer the following questions to track what the attacker did after successfully establishing a foothold on the server.