Module 11 Insufficient Logging and Monitoring Lab

Description: In this lab, you will determine if sufficient logging is taking place on the Web
server. We will first run a password attack against the login page and then review the log
files to determine if there is sufficient logging and monitoring in place.
Requirements:​ You will need access to the Cybrary lab environment for this lab.

Step 1:​ Log into Cybrary

Step 2:​ Launch the ​OWASP Insufficient Logging & Monitoring​ lab by searching for it in
the catalog and selecting the launch button
Note: It may take 30-40 seconds for the lab to launch after clicking the button.

Step 3:​ When the lab opens, you will see a pop-up box. Select the Next button, then Ok to
close the pop-up box.
Step 4:​ You will then be taken to the Kali Linux log in screen.
Step 5:​ Enter a username of ​student ​and a password of ​student ​to log into the desktop.
Step 6:​ Next, open a Terminal by clicking the black box on the left-side of the screen.
Step 7:​ At the Terminal prompt, type the following and press Enter. cat login.txt
Note: This shows us parameters for login requests.

Step 8:​ Now, we will brute force the login page with a tool called Hydra.
Step 9:​ Enter the following and press Enter.
hydra -f -l admin -P /usr/share/wordlists/rockyou.txt mutillidae http-post-form
“/mutillidae/index.php?page=login.php:username=^USER^&password=^PASS^&l
ogin-php-submit-button=Login:Password incorrect”

Note: It may take 1 or 2 minutes to perform the attack.

Question 1:​ Do you see any passwords? ____________________________________

 
Brought to you by:  Develop your team with the ​fastest growing catalog​ in the 
cybersecurity industry. Enterprise-grade workforce development 
management, advanced training features and detailed skill gap and 
 
competency analytics. 
1 

 
  
 
 

 
Step 10:​ Next, launch Firefox by clicking on the orange-colored icon on the left-side menu.
Step 11:​ Next, click the ​View Log​ option at the top-right of the page.

Question 2:​ Do you see any log information that shows the password attack we just performed with
Hydra? ________________________________________________

Step 12:​ Keep looking at the log information.

Question 3:​ What else do you see? ______________________________________

Question 4:​ Do you think there is sufficient monitoring going on?

___________________________________________________________________

 
Brought to you by:  Develop your team with the ​fastest growing catalog​ in the 
cybersecurity industry. Enterprise-grade workforce development 
management, advanced training features and detailed skill gap and 
 
competency analytics. 
2