topic Re: splunk wildcard search in Splunk Search

splunk wildcard search

Mouseman123 — Fri, 03 Nov 2023 07:50:10 GMT

I am very new to SPLUNK and practicing using the botsv1 index.

I need to use a "Wild Card" to find all the passwords used against a destination IP.

I know I need to use the http_method= Post and search for the user passwords within the form_data field.

I have been experimenting with the SPL command but no success as of yet

Re: splunk wildcard search

ITWhisperer — Fri, 03 Nov 2023 09:49:19 GMT

Since everyone is not familiar with the data set you are referring to, please can you provide some examples of the events you are trying to find. Also, please share the SPL you have already tried, so we can see where you might be going wrong.

Re: splunk wildcard search

Mouseman123 — Fri, 03 Nov 2023 11:25:04 GMT

The dataset I am using is "Boss of the Sock Version 1" - "botsv1"

Index="botsv1"

My assessment question is as follows:
Use a "wild card" search to find all passwords used against the destination IP. As a hint, you will need to use a specific http_method= as the attack was against a web server. You will also need to pipe the result into a search that uses the form_data field to search for user passwords within the form_data. What is the SPL statement used?

Warning!
My SPL may be all over the place but here it is:

Index="botsv1" dest_ip="192.168.250.70" "http_method=POST form_data"*" source:"stream:http"

| table form_data, src_ip, password

I am very new here!
Your help is much appreciated

Re: splunk wildcard search

ITWhisperer — Fri, 03 Nov 2023 11:47:44 GMT

So, what events are returned from the first part of your search with http_method="POST"?

Re: splunk wildcard search

Mouseman123 — Sat, 25 Nov 2023 02:10:51 GMT

Sorry,

I assumed the dataset "botsV1" was very widely known.

Thankyou for responding to my question however I have been able to solve the issue.