Investigation

Platform: taipanbyte | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-02-14 | Status: Solved Techniques: log_analysis, status_code_anomaly_detection, sqli_pattern_recognition, hex_decoding, chronological_reconstruction

Summary

Investigation — TaipanByte

Description

По результатам непрерывного мониторинга средств защиты информации подведомственного учреждения в период мониторинга зафиксированы косвенные признаки реализации успешной кибератаки на информационный ресурс учреждения. Задача — провести полный анализ предоставленных журналов сетевой активности веб-сервера (файл access.log), идентифицировать следы несанкционированного воздействия и извлечь артефакты, доказывающие компрометацию системы.

Analysis

Reconnaissance

• File: access.log — 10,000 lines, standard Apache combined log format
• Time range: 25/Jan/2024 14:30:00 — 26/Jan/2024 05:42:53
• 21 unique IP addresses, relatively even distribution (421–517 requests each)
• HTTP methods: GET, POST, PUT, DELETE, HEAD, OPTIONS
• Direct flag search (TB{}, FLAG{}, ctf{}) — nothing found ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Anomaly Detection via HTTP Status Code Analysis

The key moment — analyzing HTTP status codes revealed 26 records with SELECT value in the response code field. This happened because SQL injections in the URL broke the log field parsing — the payload contained spaces, causing field shifts.

 bash read-only • copy allowed Copy
awk '{print $9}' access.log | sort | uniq -c | sort -rn

Result:

 4820 200
 2100 404
 1500 302
  800 301
  500 304
  200 403
   54 500
   26 SELECT    ← anomaly!

Attack Identification

All 26 anomalous records — requests to /search.php with SQL injection:

GET /search.php?q=admin' UNION SELECT CHAR(X'54')-- HTTP/1.1
GET /search.php?q=admin' UNION SELECT CHAR(X'42')-- HTTP/1.1
GET /search.php?q=admin' UNION SELECT CHAR(X'7b')-- HTTP/1.1
...
GET /search.php?q=admin' UNION SELECT CHAR(X'7d')-- HTTP/1.1

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Attack Characteristics

• IP rotation: requests distributed across different IP addresses to evade detection
• User-Agent rotation: Chrome, Firefox, curl, python-requests, Googlebot, PostmanRuntime
• Attack time range: 25/Jan/2024 20:37 — 23:34 (~3 hours)
• Target endpoint: /search.php?q= (vulnerable to SQL injection)
• Technique: character-by-character data exfiltration via UNION SELECT CHAR(X'hex')

Solution

1. HTTP Status Code Analysis

 bash read-only • copy allowed Copy
# Detect anomaly — SELECT instead of numeric code
awk '{print $9}' access.log | sort | uniq -c | sort -rn

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. SQL Injection Investigation

 bash read-only • copy allowed Copy
# Find all requests with SELECT
grep 'SELECT' access.log

3. Flag Extraction and Decoding

 bash read-only • copy allowed Copy
# Sort by time, extract hex from CHAR(X'...'), decode
grep "UNION SELECT CHAR" access.log | sort -t'[' -k2 | \
  sed "s/.*CHAR(X'\([0-9a-fA-F]*\)').*/\1/" | \
  while read hex; do printf "\\x$hex"; done; echo

26 requests contained hex values:

54 42 7b 53 51 4c 5f 49 6e 6a 65 63 74 69 6f 6e
5f 44 65 74 65 63 74 65 64 7d

Decoding hex → ASCII:

T  B  {  S  Q  L  _  I  n  j  e  c  t  i  o  n
_  D  e  t  e  c  t  e  d  }

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Log Analysis Methodology

Notes

• Key insight: the anomaly in the status code field — SELECT instead of a number — became the entry point for the investigation. SQL injection in the URL contained spaces that broke Apache log format field parsing.
• The attacker applied OPSEC measures (IP/UA rotation), but the payloads themselves were easily detectable through response code analysis.
• The UNION SELECT CHAR(X'hex') technique is a classic method for character-by-character exfiltration via SQL injection. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍