Who keeps pushing?
Il Forno Veloce sells bread online and its web server is under siege: last night the access log filled up with wrong passwords. Knowing that someone is pushing is not enough, you must know WHO pushes hardest. Count the failed attempts per address and decode the attacker's report.
Lab 2 of 6 in the Blue Team / Defense path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 50 and 120 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Isolate the failed attempts with grep (80 XP)
- Extract the address column with cut (100 XP)
- Group and count with sort and uniq -c (120 XP)
- Decode the attacker's report (100 XP)
Topics: defense, log, pipe, brute-force.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.head: shows only the first lines of a file, handy for understanding a log format without reading all of it.cut: extracts one column from each line using a chosen separator, to isolate a specific field of a log.sort: sorts lines, numerically (-n) or in reverse (-r) too.uniq: removes repeated adjacent lines and counts them with -c: together with sort it builds rankings, such as the most insistent addresses.base64: encodes and decodes Base64, the format that turns bytes into text. It protects nothing: it can be undone without a key.|: the vertical bar | chains commands: the output of the first becomes the input of the next, so small tools form a complete analysis.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
With grep, cut, sort and uniq -c a log of hundreds of lines becomes a ranking: whoever pushes hardest is almost always running a brute-force attack. But the numbers must be read with care: an internal script with the old password or an absent-minded user are not attackers, and a slow, scattered attack slips under the threshold. Defense: limit attempts per address (rate limiting), automatically ban whoever crosses the threshold with fail2ban, and switch from passwords to SSH keys.
Before and after this lab
To unlock it you must have solved:
- Reading an access log (Blue Team / Defense, easy)
- Pipes and filters (Linux Fundamentals, medium)
After this lab you can move on to:
- Timeline of an incident (Blue Team / Defense, medium)
The Blue Team / Defense path
Blue Team / Defense is the path of those who protect. You read access logs, count failed attempts to find out who is forcing a login, rebuild the timeline of an incident, compare an SSH configuration with the recommended one, shut down unnecessary services and handle incident response in four steps: detect, contain, clean up, document. The commands are the same as in the other paths, but used through the eyes of someone who must understand what happened and stop it from happening again.