LOG ANALYSIS & FORENSICS
Lesson 3 of 5WARMUP: Find the Anomaly
Below is a sample server log. One entry is suspicious — can you spot it?
What's wrong? Why did the request from 10.0.0.5 get a 200 when the previous admin request got a 403?
CORE CONCEPTS
Logs are records of events that happen on a system. Every time you visit a website, download a file, or log in, an entry is probably written somewhere.
Apache logs follow a standard format. Each line contains: IP, timestamp, request method, path, status code, and size.
Notice the pattern: repeated 401s from 10.0.0.99, then suddenly a 200. Classic brute-force sign!
Security analysts look for patterns like repeated failed logins, strange IPs, or unexpected status codes.
MINI CHALLENGE: Find the Hacker in the Log
Examine the log below and identify the attacker's IP address. Look for patterns!
backup.sql file?
MAIN PROJECT: Log Attack Pattern Detector
Write in Python (pseudocode or real) a script that reads a log file and identifies attack patterns: brute force logins, directory scanning, and suspicious IPs.
Read log file line by line
Count failed logins per IP (status 401)
Flag IPs hitting many different paths
Generate a summary report of threats
QUIZ: Log Analysis
Check your forensic investigation skills.
1. What HTTP status code means "Not Found"?
2. A single IP making many 401 requests suggests what?
3. What should you NEVER expose in a public web directory?