{"id":1488,"date":"2026-01-13T19:56:00","date_gmt":"2026-01-13T19:56:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=1488"},"modified":"2026-01-13T17:56:51","modified_gmt":"2026-01-13T17:56:51","slug":"detecting-web-attacks","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=1488","title":{"rendered":"Detecting Web Attacks"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/detectingwebattacks<\/a>
Created by: tryhackme, ryla, TactfulTurtle<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

THM links to other rooms per the prerequisites. These rooms cover the most recent update to OWASP!

“OWASP\u00a0Top 10<\/a>\u00a0covers the ten most critical web security risks. Complete\u00a0Intro to Log Analysis<\/a>\u00a0for an overview of logs and useful indicators. Wireshark: The Basics<\/a>\u00a0provides a great introduction to packet capture analysis.”<\/p>\n\n\n\n

Task 2: Client-Side Attacks!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Before we address our questions, THM links to two other rooms: https:\/\/tryhackme.com\/room\/axss for XSS attacks and https:\/\/tryhackme.com\/room\/csrfV2 for CSRF attacks.

For questions “What class of attacks relies on exploiting the user’s behavior or device?” and “What is the most common client-side attack?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 3, Server-Side Attacks!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

THM links to three rooms in this task: https:\/\/tryhackme.com\/room\/passwordattacks, https:\/\/tryhackme.com\/room\/sqlinjectionlm, and https:\/\/tryhackme.com\/room\/oscommandinjection\/

For questions: “What class of attacks relies on exploiting vulnerabilities within web servers?” and “Which server-side attack lets attackers abuse forms to dump database contents?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 4, Log-Based Detection! It appears that this room will be more technical than the previous tasks.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We are tasked with opening a log file from the desktop to obtain our answers.

“What is the attacker’s User-Agent while performing the directory fuzz?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the name of the page on which the attacker performs a brute-force attack?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the complete,\u00a0decoded<\/a>\u00a0SQLi payload the attacker uses on the\u00a0\/changeusername.php<\/code>\u00a0form?”

CyberChef time! Usually, they have the offline version available in the VM, but I’m not seeing it. Go to cyberchef.org.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 5, Network-Based Detection!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Navigate to the traffic.pcap file from the desktop, and it will load Wireshark.

“What password does the attacker successfully identify in the brute-force attack?”

We can use this search filter to find successful logins(302).<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“What is the flag the attacker found in the database using SQLi?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

On to the last task, Web Application Firewall!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

For the questions “What do WAFs inspect and filter? and “Create a custom firewall rule to block any\u00a0User-Agent<\/code>\u00a0that matches\u00a0\"BotTHM\"<\/code>.”<\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/detectingwebattacksCreated by: tryhackme, ryla, TactfulTurtle THM links to other rooms per the prerequisites. These rooms cover the most recent update to OWASP! “OWASP\u00a0Top 10\u00a0covers the ten most critical web security risks. Complete\u00a0Intro to Log Analysis\u00a0for an overview of logs and useful indicators. Wireshark: The Basics\u00a0provides a great introduction to packet capture analysis.” Task 2: Client-Side […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1488","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1488"}],"version-history":[{"count":1,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1488\/revisions"}],"predecessor-version":[{"id":1508,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1488\/revisions\/1508"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}