DVWA XSS 로그(apache/mysql)

• apache log : /etc/httpd/log/access.log
• mysql log : /var/log/mysql/mysql.log
  (my.cnf에서 general_log 또는 log 설정 필요)

DVWA

Reflected(Get) 일반 사용 로그

iqsp입력

iqsp 입력 결과

Url :

http://172.16.20.14/dvwa/vulnerabilities/xss_r/?name=iqsp#

 

Apache Log :

172.16.20.1 - - [21/Oct/2024:21:21:39 -0400] "GET /dvwa/vulnerabilities/xss_r/?name=iqsp HTTP/1.1" 200 4338 "http://172.16.20.14/dvwa/vulnerabilities/xss_r/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"

 

Mysql Log :

241021 21:21:39    8379 Connect     root@localhost on
                   8379 Init DB     dvwa
                   8379 Quit

 

 

Reflected(Get) 공격 로그

<script>alert()</script>

Url :

http://172.16.20.14/dvwa/vulnerabilities/xss_r/?name=%3Cscript%3Ealert%28%29%3C%2Fscript%3E#

 

Apache Log :

172.16.20.1 - - [21/Oct/2024:21:30:21 -0400] "GET /dvwa/vulnerabilities/xss_r/?name=%3Cscript%3Ealert%28%29%3C%2Fscript%3E HTTP/1.1" 200 4358 "http://172.16.20.14/dvwa/vulnerabilities/xss_r/?name=iqsp" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"

 

Mysql Log :

241021 21:30:21    8380 Connect     root@localhost on
                   8380 Init DB     dvwa
                   8380 Quit

 

 

 

Stored(Post) 일반 사용 로그

Url :

http://172.16.20.14/dvwa/vulnerabilities/xss_s/

 

Apache Log :

172.16.20.1 - - [21/Oct/2024:21:36:36 -0400] "POST /dvwa/vulnerabilities/xss_s/ HTTP/1.1" 200 4922 "http://172.16.20.14/dvwa/vulnerabilities/xss_s/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"

 

Mysql Log :

241021 21:36:36    8382 Connect     root@localhost on
                   8382 Init DB     dvwa
                   8382 Query       INSERT INTO guestbook (comment,name) VALUES ('HELLO','HI')
                   8382 Query       SELECT name, comment FROM guestbook
                   8382 Quit

 

 

 

Stored(Post) 공격 로그

<script>alert("Hello")</script>

 

 

Url :

http://172.16.20.14/dvwa/vulnerabilities/xss_s/

 

Apache Log :

172.16.20.1 - - [21/Oct/2024:21:46:56 -0400] "POST /dvwa/vulnerabilities/xss_s/ HTTP/1.1" 200 4948 "http://172.16.20.14/dvwa/vulnerabilities/xss_s/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"

 

Mysql Log :

241021 21:46:56    8394 Connect     root@localhost on
                   8394 Init DB     dvwa
                   8394 Query       INSERT INTO guestbook (comment,name) VALUES ('<script>alert(\"Hello\")</script>','HI')
                   8394 Query       SELECT name, comment FROM guestbook
                   8394 Quit