Forum Discussion
CVE-2022-33891 (Apache Spark) – Defensive Question 8
I am wondering about what I am missing in terms of:
Analyze the log files. At what time does the attacker first discover that the Apache Spark engine is accessible? (Provide your answer in the format HH:MM:SS)
I cant seem to get the time right. unless if I am looking at the wrong area.
1 Reply
- autom8on
Ambassador
Grep for the attacker's IP address in the access.log file. You're looking for the very first time they hit the service at all (so getting a 302 when they grab '/', not the subsequent looking at "/?doAs").
