A Survey : Server timeline analysis for web forensics

World Congress on Internet Security (WorldCIS-2014), 2014

Symantec Internet Security Threat Report 2014 is showing a horrified fact, that when an attacker looked for a site to compromise, one in eight sites made it relatively easy to gain access. Many attackers are arrested due to the evidences obtained by computer forensics. The victim machine usually gives some data, which are then used for identifying possible suspects, which is followed by forensic analysis of their devices, like computers, laptops, tablets, and even smart phones. In this paper, we use an attack scenario on the known vulnerable web application WackoPicko, of three types of attacks: SQL Injection, stored XSS, and remote file inclusion, usually performed by using a web browser. We use post-mortem computer forensic analysis of attacker and victim machine to find some artifacts in them, which can help to identify and possible to reconstruct the attack, and most important to obtain valid evidence which holds in court. We assume that the attacker was careless and did not perform any anti-forensic techniques on its machine.

2014

Symantec Internet Security Threat Report 2014 is showing a horrified fact, that when an attacker looked for a site to compromise, one in eight sites made it relatively easy to gain access. Many attackers are arrested due to the evidences obtained by computer forensics. The victim machine usually gives some data, which are then used for identifying possible suspects, which is followed by forensic analysis of their devices, like computers, laptops, tablets, and even smart phones. In this paper, we use an attack scenario on the known vulnerable web application WackoPicko, of three types of attacks: SQL Injection, stored XSS, and remote file inclusion, usually performed by using a web browser. We use post-mortem computer forensic analysis of attacker and victim machine to find some artifacts in them, which can help to identify and possible to reconstruct the attack, and most important to obtain valid evidence which holds in court. We assume that the attacker was careless and did not per...

IJCSPUB, 2023

Internet Forensics is a process of preservation, identification, extraction, and documentation of internet activities for investigation purposes. It is a science of determining evidence from internet platforms like emails, Webpages, and social media (SM). Moreover, it helps the forensic team with the best possible approaches and tools to solve complicated internet cases with the tracking of browser history, scripting, and heading information used by the web servers and the sources, substance, patterns, and transmission routes of emails and Web pages. Most widely generated from the Social Media platform followed by Webpages and emails and hence it is necessary to make research such information. The widespread use of Cloud Computing and Social Networking requests has resulted in a thorough investigation of Online Social Forensic investigation. The main concern is security and observing the pointed development in social network operators. This study investigated various kinds of internet forensics such as Email forensics, social media forensic, Network forensic, and Web forensic analysis which the review papers are analyzed using these four forensic analyses. A total of 25 papers were selected for this survey in which the advantages, disadvantages, and experimental studies are discussed.

2019 7th International Symposium on Digital Forensics and Security (ISDFS), 2019

Web forensics is a discipline that has legal and technical aspects and deals with a continuously expanding problem. This study has been conducted for two reasons-to answer the question ‘Can criminal tendency be detected from web activities?’ and to contribute to technical developments in computer forensics. Criminal records for conventional and cybercrimes committed in Turkey, detection of criminals, the sentences given, and the methods used have been examined. The technical developments in the literature dealing with web forensics have been investigated and emphasis has been laid on the types of crimes to be handled in order to develop new models. The process, method, technique, application and software of the web forensics procedure, which handles web activities, have been investigated. We observed that problems are encountered mainly at the stage of evidence analysis. The crime models that were analyzed in the legal department were determined in order to create a database for new...

International Journal of Computer Network and Information Security, 2015

Nowadays, web applications are popular targets for security attackers. Using specific security mechanisms, we can prevent or detect a security attack on a web application, but we cannot find out the criminal who has carried out the security attack. Being unable to trace back an attack, encourages hackers to launch new attacks on the same system. Web application forensics aims to trace back and attribute a web application security attack to its originator. This may significantly reduce the security attacks targeting a web application every day, and hence improve its security. The aim of this paper is to carry out a detailed overview about the web application forensics. First, we define the web applications forensics, and we present a taxonomic structure of the digital forensics. Then, we present the methodology of a web application forensics investigation. After that, we illustrate the forensics supportive tools for a web application forensics investigation. After that, we present a detailed presentation of a set of the main considered web application forensics tools. Finally, we provide a comparison of the main considered web application forensics tools.

International Journal of Internet Technology and Secured Transactions, 2015

Symantec Internet Security Threat Report 2014 is showing a horrified fact, that when an attacker looked for a site to compromise, one in eight sites made it relatively easy to gain access. Digital forensics is one of our biggest line of defense against cyber criminals, because it provides evidence against them. For attacks against web applications, web application forensics is the branch which gives most of the answers. First, the victim machine usually gives some data, which are then used for identifying possible suspects, and this is followed by forensic analysis of suspects' devices, like computers, laptops, tablets, and even smart phones. In this paper, we use an attack scenario against the known vulnerable web application WackoPicko, using several web attacks: SQL Injection, stored and reflected XSS, remote file inclusion, and command-line injection. We use post-mortem computer forensic analysis of attacker and victim machine to find some artifacts in them, which can help to identify and possible to reconstruct the attack, and most important, to obtain valid evidence which holds in court. We assume that the attacker was careless and did not perform any antiforensic techniques on its machine.

International Journal of Electrical and Computer Engineering (IJECE), 2018

In today's digital era almost every aspect of life requires the internet, one way to access the internet is through a web browser. For security reasons, one developed is private mode. Unfortunately, some users using this feature do it for cybercrime. The use of this feature is to minimize the discovery of digital evidence. The standard investigative techniques of NIST need to be developed to uncover an ever-varied cybercrime. Live Forensics is an investigative development model for obtaining evidence of computer usage. This research provides a solution in forensic investigation effectively and efficiently by using live forensics. This paper proposes a framework for web browser analysis. Live Forensics allows investigators to obtain data from RAM that contains computer usage sessions. Web browser.

Aslib Proceedings, 2001

As has been described elsewhere, web log files are a useful source of information about visitor site use, navigation behaviour, and, to some extent, demographics. But log files can also reveal the existence of both web pages and search engine queries that are sources of new visitors. This study extracts such information from a single web log file and uses it to illustrate its value, not only to the site owner but also to those interested in investigating the online behaviour of web users.