Linux terminal
Works like any Linux server. Work out an overnight break-in from raw logs with real commands.
Works like any Linux server. Work out an overnight break-in from raw logs with real commands.
You're logged in to lakeshore-web01, the web server at Lakeshore Family Health. Something happened there overnight, and the answers are in the raw logs. Lakeshore Family Health answers to HIPAA, so the details have to be exact. (A made-up company. Start with cat notes.txt.)
Linux 6.8.0 x86_64. Practice server, built for you. Your brief is in notes.txt. Type help to see the commands.
1. Which IP address brute-forced SSH?
2. How many failed password attempts came from that address?
3. Which account did the attacker get into?
4. Which IP address sent the most 404s to the website?
5. What file did the attacker leave in /tmp?