Insufficient Logging & Monitoring
What does Insufficient Logging & Monitoring means?
Exploitation of insufficient logging and monitoring is the bedrock of nearly every major incident. Attackers rely
on the lack of monitoring and timely response to achieve their goals without being detected.
Most successful attacks start with vulnerability probing. Allowing such probes to continue can raise the
likelihood of successful exploit to nearly 100%.
In 2016, identifying a breach took an average of 191 days – plenty of time for damage to be inflicted.
This lab helps you to get an idea of how sometimes improper logging can result in information disclosure.
The user on accessing the lab is given with a login page which tells us that the logs have been leaked.
The user needs to find the leak and try to gain the credentials that have been leaked in the logs.
Finding the Log
- The log has been exposed in
/debugroute - This can be found out with subdomain brute-forcing or just by guess
- On seeing the Log try to get the required login details as there is a leak and the logging is improperly handled.
It seems this application is logging every action performed in this logging page.
But is there a way to inject some fake logs to the application?
Login credentials are same as lab1
Mitigation
- Ensure that logs are created in a format that can be easily used by central log management tools.
- High-value transactions should have an audit trail with integrity controls to prevent manipulation or deletion.
- Effective monitoring and alerting should be established so that suspicious activities can be detected and responded to in a timely manner.
- Make sure that there aren't any sensitive information like passwords are being logged