Web attack

Web application attack playbook

Decide whether an attack on a website succeeded, was blocked, or was just a scan.

Use this when: A web application firewall alert such as SQL injection, scripting or path traversal.

Steps

0 of 6 ticked

1. Read the requestLook at the URL and parameters. Does it contain code such as ' OR 1=1-- or <script>? Is the User-Agent an attack tool such as sqlmap?
2. Was it blocked?A BLOCK action and a 403 response mean the firewall stopped it. That does not make the alert a false positive. It is a real attack that failed.
3. Did anything reach the application?Check the application's access log for the same requests, and the response codes and sizes. A 200 with a large response is a warning.
4. Check for damageLook in the database and application error logs for errors or unusual queries around the same time.
5. Judge the source and scopeOne address or many? Seen before? Does a penetration test explain it?
6. Decide and recommendBlocked and nothing got through: record it, block or rate-limit the source and keep watching. Got through: escalate immediately.

WAF logsApplication access logIntel lookup

Found something confusing or unrealistic?