Find the web shell in your own access log

short · 45 min · Objective 1.2

Task

Generate ordinary web traffic and one web-shell-shaped request against a server you are running, then find the second in the first without searching for the filename you chose.

Steps

  1. Install a web server with PHP on the Linux VM and start it. Serve a small site with a few pages and an uploads directory.
  2. Generate normal traffic: fetch each page twenty or thirty times from the Windows VM, with a browser user agent, in a plausible order.
  3. Write uploads/report.php containing a line that echoes a fixed string when given a parameter. Do not give it the ability to execute anything -- the shape is what matters, not the capability.
  4. Request it a handful of times with a parameter, using curl with no user agent set.
  5. Now find it from the access log alone. Do not grep for report.php. Use these questions instead: which paths are requested by only one client, which requests have no referrer, which are in a directory that should only ever be written to, and which user agents appear on only a few requests.

Verify

awk '{print $7}' /var/log/apache2/access.log | sort | uniq -c | sort -n | head -5
awk '$7 ~ /^\/uploads\// {print $7}' /var/log/apache2/access.log | sort -u
awk -F'"' '{print $6}' /var/log/apache2/access.log | sort | uniq -c | sort -n | head -5

The first shows the rarest paths -- your shell should be near the top of a rarity-sorted list. The second must return your PHP file: a script under an uploads directory is a finding on its own, regardless of what it contains. The third isolates the odd user agent.

Notes

The second command is the one worth keeping. "An executable file type in a directory that only receives uploads" needs no signature, no threat feed and no knowledge of the attacker, and it catches the entire class.

Repeat the exercise with the shell named index.php and placed alongside the real pages. Note which of your three checks still finds it and which do not -- that difference is why detection uses several weak signals rather than one.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.