Hello,
https://app.letsdefend.io/challenge/investigate-web-attack
I have a question regarding this challenge. There is a log file named access.log and there are thousands of row in the file. After directory enumeration phase and between the rows 400-600 there exists multiple recordings of logs like below.
192.168.199.2 - - [20/Jun/2021:12:36:31 +0300] “GET /bwapp/authLogin.cgi HTTP/1.1” 404 300 “() { ; } >[$($())] { echo Nikto-Added-CVE-2014-6278: true; echo;echo; }” “() { :; }; echo Nikto-Added-CVE-2014-6271: true;echo;echo;”
I thought this was a command injection attack but it is not covered in the questions at all. Could you assist me with this ?
Thank you for your time.