Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Reconstruct Attack Scenario from Multiple Logs
Mission
Correlate `web.log`, `auth.log`, and `db.log` by session ID to reconstruct the intrusion from the web attack through successful authentication to database access. Retrieve the flag from the final database result row.
Hints
Hint 1 Show
In web.log find SQLi/path-traversal traces plus the attacker IP and session id
Hint 2 Show
Follow that session id in auth.log to see the successful intrusion
Hint 3 Show
Follow the same session id in db.log; the final data-exfil line holds the flag