Investigate Web Attack

Challenges
1

Hello,

https://app.letsdefend.io/challenge/investigate-web-attack

I have a question regarding this challenge. There is a log file named access.log and there are thousands of row in the file. After directory enumeration phase and between the rows 400-600 there exists multiple recordings of logs like below.

192.168.199.2 - - [20/Jun/2021:12:36:31 +0300] “GET /bwapp/authLogin.cgi HTTP/1.1” 404 300 “() { ; } >[$($())] { echo Nikto-Added-CVE-2014-6278: true; echo;echo; }” “() { :; }; echo Nikto-Added-CVE-2014-6271: true;echo;echo;”

I thought this was a command injection attack but it is not covered in the questions at all. Could you assist me with this ?

Thank you for your time.

2

it is a code injection command and in letsdefend we only taught to defend again them, so there’'s no point of being going in detail over the attack, you just have to know the pattern and how to find them which is being taught quite well in this lesson. If you want to know more about this code then it will be not be covered in letsdefend, and will be available to practice in a read team platform.