SDF: Weblog Forensics

In this section we are going to look at the different aspects of the artifact and focus on the valuable part of the record for investigations.

This lecture explains Apache weblogs and why it is one of the core forensic artifacts examiners use for investigations.

This lecture breaks down weblogs into its different forensic components to help examiners better understand the information the artifact contains.

This lecture breaks down weblogs into its different forensic components to help examiners better understand the information the artifact contains.

This lecture breaks down weblogs into its different forensic components to help examiners better understand the information the artifact contains.

This lecture breaks down weblogs into its different forensic components to help examiners better understand the information the artifact contains.

This lecture breaks down weblogs into its different forensic components to help examiners better understand the information the artifact contains.

This section reviews common investigative approach is for weblog triage

This module details common investigative approaches that will be expanded upon in later sections.

A reminder to include logging validation artifacts in the initial stages of the investigation.

This section teaches you how to conduct IOC sweeps on weblogs.

This module is a hands on exercise that teaches you how to run an IOC search.

This module is a hands-on exercise that teaches you how to run an IOC search

This section teaches you how to build different types of frequency analysis searches to find investigative leads to advance your investigation

This module teaches you how to build a frequency analysis search based on HTTP request method

This module teaches you how to build a frequency analysis search based on IP addresses

This module teaches you how to build a frequency analysis search based on HTTP status codes

This module teaches you how to build a frequency analysis search based on user agents

This module teaches you how to build a frequency analysis search based on byte-size

This section teaches you how to build searches that detect different types of attack happens

This module teaches you how to build a search to detect SQL injection

This module teaches you how to build a search to detect SQL injection

This module teaches you how to build a search to detect web shells

This module teaches you how to build a search to detect web shells

This module teaches you how to build a search to detect cross site scripting

This module teaches you how to build a search to detect cross site scripting

This module teaches you how to build a search to the text base64 encoding

This module teaches you how to build a search to detect long URL strings

This module teaches you how to build a search to detect directory traversal

This module teaches you how to build a search to detect hexing coding

This section teaches you how to combine everything you have learned into a script so you can automate web log triage process

script download

This module provides an overview of the script

This module provides a demonstration of the script

This module provides a more detailed breakdown of the script

A review of the key points learned during class

Thank you for checking out the Surviving Digital Forensic Training Series!

Be sure to check out the other classes in the series here at Udemy.

Check out the Digital Forensics Survival Podcast and listen to talk about computer forensic analysis, techniques, methodology, tool reviews and more http://digitalforensicsurvivalpodcast.com