Right on the last lecture, we got this Hirakata stuff set up, which was really, really fun.
Hopefully you're all caught up.
You have any questions?
Just leave a comment.
Reach out to me.
You know, I'll do the best I can to help you get to where you need to be with the cyber age.
But now we're going to set up shop.
I'm going to make sure that the Duchamp logs are being shipped into Splunk.
So the first thing we need to do is, as I say, it's due to shop blocking its route
control.
Then maybe we need to organise to use.
There you go.
All right, so we're logged in here and let's edit the config file.
So we're going to go to the Splunk photo directory.
That's the system.
The local inputs, dot com are going to create this file to create.
I'm going to tell it what to monitor.
So we'll put monitoring brackets, colon woak for that model, e-mail everything in this directory we
want to monitor host equals Duchamp.
Source type equals juice shop index equals network scape shivs.
Easy.
And let's just make sure it looks the way we expect we got that leading forward slash, all right?
It does.
Now, we can just commit those changes by restarting the forwarder and we're going to say restart.
All right, that's good, but we need to make sure everything's still good, so if we look at the images,
you can see we've got our job image.
You look at Dukkha.
Yes, nothing's running.
Right.
So right now, if we try to go to job, nothing's going to happen.
The application is not running and we look at all the processes.
There's nothing here.
So we need to actually pull it down.
That's what we're going to do, is we're going to run Sido Dukkha run privileged.
OK, this means that the container has privileged that is elevated access to our host, in this case,
the juice lutetium, which is bad obviously.
But this is our lab.
We want to make things intentionally vulnerable so we can break and learn.
We're going to put it in demon mode and we're going to use the UID
for the folder.
And everybody, these are the volumes we're going about.
So we're going to set up a persistent volume mounted from our host.
That is our going to the to the shop logs.
The G shop logs directly inside the container will name the container juice container.
If you don't do this, it'll come up with a random name.
And I don't like randomness right now.
If it doesn't have to be random, we shouldn't let it be random and then we'll just put everything in
place or press enter that house means it should be running.
Docker has to see the running containers.
It's running very nice.
You can see that it's mapping the binding to all ipis on the host report.
Three thousand in its mapping that two point three thousand inside the container.
As we're showing you here, it's hard just like this.
That's what I'm showing you here.
And this is the name of our container, just container right now.
It's we start the forwarder again.
And if we look at the of the e-mail directory, you can see there is a log in there, right.
And a timestamp is showing, let's see, 15, 20, two.
If we go into the Docker container Docker exact interactive terminal, which is container giving, shell
juice shop logs can actually tell.
And so we've got these so both of these directories from the container to the hoster, synchronized
exit the container and let's generate some more logs so we go here, should be able to type in the address.
Should anybody get request against that webapp that should write to this log here.
I guess we could have had tell rolling the whole time.
So something really fun you can do as you can type watch.
It's like a type like watch Intervale, I see this works that I can do till
like this.
Right, and then when I refresh, you should see that like update.
There we go.
See, I just updated that.
Now we're seeing the requests coming in real time in the log.
So pretty cool Thanksgiving, if you don't know it now, you know it.
All right, watch now.
Speaking of watch, let's watch the logs and see if it was correctly ingested.
So I'm going to flip over to the Splunk Enterprise logo and I'm going to go into the search and reporting
app.
Suchin reporting.
You guys remember the index and source type we created?
You're about to pop that in now.
Index equals network source type equals juice shop.
Do we have lots?
Nothing.
It's the Coast Eagles shop.
Let's see if we can figure out what is wrong.
So I'm going to go back and I want to look at the data summary to see if we see the Jews host here,
because if we do, we know the lines are getting here.
We do see Jews.
So let's quick at.
I think Jews.
What was the source that.
Access to small access, small.
OK, so maybe that's why we weren't seeing it, because we were using the wrong source type.
Why is the access log to small?
What is the index?
Index's main, so getting here is just not using.
The stuff that we put in for this source type and index, let me quit this for a second.
Let's press let's see, being four for seven.
That looks right, hostages.
OK, so.
You know, I don't it's like it's using it's like it's using a different input's file.
And not the one that we specifying here so we could check that Colin, cute thing to find out Root and
let's just do a search for like input's dotcom type is a file and let's send all the arrows to them.
No, if you have any.
So there's a bunch of input's knockoffs and we probably want to search any of these for I guess we could
cut them out so we can say exactly
grap what will we look for at Sipah Index equals network out there.
Why isn't it carrying out the files?
Because I need that space between the plus and the brace.
OK, go back here.
But this base in.
And we're seeing that in that one file that we created with nowhere else, so here I saying there's
a whole sequel to Jews, so can we just look for that?
Most equal to just see potentially what file that's coming from.
So there is no other file overwriting, this looks like this is the only file and it has the word use
and introduce shop, so I don't know where it's getting this stuff from.
But anyway, we got it to work.
OK, it's not working completely.
Maybe we'll come back and troubleshoot that.
But at this point, you know, we got to a point where we do have our logs here.
Now, you do notice that it's not being passed the way you want it to be, and that's because.
Do you shop doesn't have a right, there's no spunk at produce shop, so we're going to have to manually
pass these logs.
But the point is we have the locks here.
So, you know, we'll be able to look at our attacks and adapt.
All right, so in the next lecture, we are going to finish installing some of the apps that we need
and then should be done with this campus party.
Got it by.