Web Application Attack Investigation

Question 1

Question

What is the likely IPv4 address of someone from the Po1s0n1vy group scanning imreallynotbatman.com for web application vulnerabilities?

Objective

Identify the external IP performing web vulnerability scanning against imreallynotbatman.com.

Investigation

List all source IP addresses communicating with the web server.

index=* imreallynotbatman.com
| stats count by src_ip
| sort -count

The internal web server is:

• 192.168.250.70 → imreallynotbatman.com

Investigate the suspected external IP.

index=botsv1 imreallynotbatman.com src_ip=40.80.148.42

Answer

40.80.148.42

Question 2