Isaca CCOA Exam - Topic 1 Question 9 Discussion

To determine the date the webshell was accessed from the investigation22.pcap file, follow these detailed steps:

Step 1: Access the PCAP File

Log into the Analyst Desktop.

Navigate to the Investigations folder on the desktop.

Locate the file:

investigation22.pcap

Step 2: Open the PCAP File in Wireshark

Launch Wireshark.

Open the PCAP file:

mathematica

File > Open > Desktop > Investigations > investigation22.pcap

Click Open to load the file.

Step 3: Filter for Webshell Traffic

Since webshells typically use HTTP/S to communicate, apply a filter:

http.request or http.response

Alternatively, if you know the IP of the compromised host (e.g., 10.10.44.200), use:

nginx

http and ip.addr == 10.10.44.200

Press Enter to apply the filter.

Step 4: Identify Webshell Activity

Look for HTTP requests that include:

Common Webshell Filenames: shell.jsp, cmd.php, backdoor.aspx, etc.

Suspicious HTTP Methods: Mainly POST or GET.

Right-click a suspicious packet and choose:

arduino

Follow > HTTP Stream

Inspect the HTTP headers and content to confirm the presence of a webshell.

Step 5: Extract the Access Date

Look at the HTTP request/response header.

Find the Date field or Timestamp of the packet:

Wireshark displays timestamps on the left by default.

Confirm the HTTP stream includes commands or uploads to the webshell.

Example HTTP Stream:

POST /uploads/shell.jsp HTTP/1.1

Host: 10.10.44.200

User-Agent: Mozilla/5.0

Date: Mon, 2024-03-18 14:35:22 GMT

Step 6: Verify the Correct Date

Double-check other HTTP requests or responses related to the webshell.

Make sure the date field is consistent across multiple requests to the same file.

Answe r:

2024-03-18

Step 7: Document the Finding

Date of Access: 2024-03-18

Filename: shell.jsp (as identified earlier)

Compromised Host: 10.10.44.200

Method of Access: HTTP POST

Step 8: Next Steps

Isolate the Affected Host:

Remove the compromised server from the network.

Remove the Webshell:

rm /path/to/webshell/shell.jsp

Analyze Web Server Logs:

Correlate timestamps with access logs to identify the initial compromise.

Implement WAF Rules:

Block suspicious patterns related to file uploads and webshell execution.