Log Hunter

Platform: hackerdna | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-02-19 | Status: Solved Techniques: attacker_footstep_tracing, automated_scanner_identification, http_status_code_filtering, user_agent_anomaly_detection

Summary

Task: Analyze Apache access.log (178 lines) to find what files attackers successfully accessed. Solution: Identified automated scanner (SecScanner/1.0) by user-agent anomaly, filtered for HTTP 200 responses among mass 404/403 enumeration attempts, found single successful access to /backup.txt containing the UUID flag.

Log Hunter — HackerDNA

Description

"Welcome to Log Hunter! You've been given access to the access log file containing suspicious activity on this server. Your mission is to analyze the log entries, identify successful attacks, and discover what files the attackers managed to access to find the hidden flag."

Given an access.log file in Apache Combined Log Format (178 lines). Hint: "The flag is a UUID located in a file that attackers successfully accessed."

Analysis

Reconnaissance

• File: access.log — 178 lines, standard Apache Combined Log Format
• Among the traffic, IP 172.16.0.88 stands out — over 100 requests
• User-Agent: SecScanner/1.0 — clearly an automated scanner
• Referer: https://attacker.com/tools — confirms malicious nature ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Attack Pattern

The attacker performed classic directory/file enumeration:

GET /admin/          → 404
GET /wp-admin/       → 404
GET /.env            → 403
GET /.git/           → 403
GET /config.php      → 404
GET /backup.zip      → 404
GET /shell.php       → 404
GET /passwords.txt   → 404
...

The vast majority of requests returned HTTP 404 (Not Found) or 403 (Forbidden).

Key Finding

Filtering by HTTP 200 among scanner requests revealed a single successful request:

172.16.0.88 - - [22/Jul/2025:08:32:44 +0000] "GET /backup.txt HTTP/1.1" 200 42 "https://attacker.com/tools" "SecScanner/1.0"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

• Path: /backup.txt
• Status: 200 OK
• Size: 42 bytes — exactly the size of a UUID flag with "FLAG: " prefix

Solution

Step 1: Identifying the Attacker

 bash read-only • copy allowed Copy
# Find suspicious user-agents
grep -oP '"[^"]*"$' access.log | sort | uniq -c | sort -rn
# SecScanner/1.0 — 100+ requests, clearly an automated scanner

Step 2: Filtering Successful Scanner Requests

 bash read-only • copy allowed Copy
# All requests from SecScanner with HTTP 200
grep "SecScanner" access.log | grep '" 200 '

Result — a single line:

172.16.0.88 - - [22/Jul/2025:08:32:44 +0000] "GET /backup.txt HTTP/1.1" 200 42 "https://attacker.com/tools" "SecScanner/1.0"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Getting the Flag

 bash read-only • copy allowed Copy
curl https://lab.hdna.me/81-log-hunter/backup.txt
# FLAG: REDACTED

Lessons

In real incident response, this same technique — filtering successful responses from known malicious sources — is fundamental for understanding the scope of compromise. Among hundreds of failed enumeration attempts, it's crucial to find those few requests that actually led to data exposure. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍