Correlating two logs | Hunt the Flag

Labs need a computer

Open this page on a computer, or make the browser window larger.

Files

misc-logs.zip
Size: 4.7 KB
SHA-256
ee5716f79d51ed7aea4d5864c9ccabac15f1448867366a5c7e4e0e7f5bd9739a
Download

After downloading, compare the file SHA-256 with the value shown here to make sure it arrived intact.

Tools you may need

grep
To filter logs by IP.
awk
To count failures per IP.

Scenario

Two Ravens server logs: an auth log and an app log. One IP brute-forces the admin login (failures then a success), and the same IP in the app log carries the token minted for the session, which is the flag.

What you are looking at

You download misc-logs.zip with auth.log and app.log mixed with normal traffic and one brute-force attack.

Goal

Find the attacker IP in the auth log, then extract its token from the app log.

What counts as solved

You enter the correct flag.

Method checklist

Tick each step as you work through it. The steps are the method, not the answer.

Analyze auth.log to find the attack IP.
Confirm a repeated-failure-then-success pattern.
Search for the IP in app.log.
Extract the token value, the flag.

Hints

You have not revealed a hint yet. Ask the falcon when you need one.