This module trains investigators to identify encoded evasion techniques within web access logs. You will learn how to construct forensic search parameters to capture variations of path traversal attacks regardless of obfuscation.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

You are investigating a potential data breach at a hosting provider located in Denver, Colorado. The incident response team suspects that an attacker successfully exfiltrated configuration files via a vulnerable web application parameter. The attacker is believed to have used obfuscation techniques to bypass primary security controls.

Evidence Collected

Forensic acquisition of the web server (Apache/IIS) access logs has been completed. Initial keyword searches for simple ../ patterns yielded no actionable hits, but anomalous HTTP 400 and HTTP 200 responses connected to a specific external IP were flagged. A manual review of a small log slice reveals the following artifacts:

192.168.1.50 - - [14/Oct/2023:13:55:36 -0600] "GET /view.php?file=..%2F..%2Fetc%2Fpasswd HTTP/1.1" 200 1024 192.168.1.50 - - [14/Oct/2023:13:56:01 -0600] "GET /view.php?file=%2e%2e%2f%2e%2e%2fetc%2Fpasswd HTTP/1.1" 200 1024 192.168.1.50 - - [14/Oct/2023:13:58:22 -0600] "GET /view.php?file=..%5C..%5CWindows%5Cwin.ini HTTP/1.1" 404 215

To properly scope the incident, analysts must conduct a bulk scan across 500GB of log data.

Question

Question 23: During an investigation at a hosting provider in Denver, Colorado, analysts must bulk-scan web server logs for path/directory traversal attempts that may appear in encoded as well as literal form. To reliably match these dot-dot-slash patterns across encodings in one pass, which expression should they apply?

Investigator Hint: Attackers often mix literal characters (like a dot) with URL-encoded equivalents (like %2E for dot, %2F for forward slash, or %5C for backslash). Look for a Regular Expression (Regex) that uses logical OR ( | ) statements to capture all these variations in a single structured sequence.

Expert Analysis

1. What evidence shows:

The extracted web server logs demonstrate a classic path traversal attack. The attacker is actively attempting to access sensitive files outside the web root (`/etc/passwd`, `win.ini`). Crucially, the logs show the attacker utilizing various URL encoding techniques (`%2F`, `%2e`, `%5C`) mixed with literal characters (`..`) to bypass basic intrusion detection or logging filters.

2. Identify forensic stage:

Log Analysis / Evidence Examination. The data collection phase is complete; analysts are now parsing and filtering the data to extract indicators of compromise (IoCs).

3. Why correct answer is correct:

Option C: ((.|%2E)(.|%2E)(/|%2F||%5C)) utilizes Regular Expressions (Regex) to account for multiple encoding methods simultaneously.

  • (.|%2E) matches a literal dot (.) OR its hex URL-encoded equivalent (%2E).
  • The second (.|%2E) matches the second dot.
  • (/|%2F||%5C) matches a forward slash (/), its hex equivalent (%2F), OR a backslash (\) / its hex equivalent (%5C).

This single regex cleanly catches ../, ..%2f, %2e%2e/, %2e%2e%5c, etc., making the bulk scan highly efficient and accurate.

4. Why others are wrong:
  • A: Invalid syntax for defining the required character variations. It does not look for dots or slashes.
  • B: %2e%2e%2f represents a strictly encoded string. It will miss literal `../` attacks or mixed iterations like `..%2f`, leading to an incomplete forensic picture.
  • D: %5C only searches for the URL-encoded backslash. While useful in isolated Windows environments, it misses standard forward slash traversal attempts and dots entirely.
5. Real-world forensic action:

Forensic investigators utilize robust CLI tools like `grep`, `egrep`, `awk`, or ingest logs into a SIEM (like Splunk or ELK). They apply this regex pattern against the URI fields in the web logs, specifically filtering for HTTP 200 (Success) response codes to determine if the traversal successfully exfiltrated data, rather than just returning 404/403 errors.

6. MINI LESSON:
  • Artifact Interpretation: Never assume attackers will use textbook cleartext payloads. Encoding (URL, Base64, Hex) is standard practice.
  • Forensic Workflow: When searching bulk data, always run queries that account for obfuscation. Relying on simple string matching (`grep "../"`) is a critical investigator error that leads to missed evidence and an incomplete chain of events.

Ready to sharpen your investigative skills further?

Explore more CHFI simulations and master the digital forensics process.

Explore more CHFI simulations