Most of this course has been about prevention: stopping an attacker from getting in. This lesson is about the other half of security — detection and response — and the control that makes it possible: logging and monitoring. It sits at position A09:2021 - Security Logging and Monitoring Failures in the OWASP Top 10.
This category is unusual. It is rarely the flaw that lets an attacker in; it is the flaw that lets them stay in unnoticed. The industry median time to detect a breach is measured in hundreds of days, and most breaches are discovered by an outside party rather than the victim. Every undetected day is a day a defender could have acted — if only the right event had been recorded and watched.
In this lesson you will:
- Open NovaCart's exposed access-log directory and read what the server records about every request.
- Decide what must never be written to a log.
- Find, inside the log, the indicator of a prior brute-force attack on the login endpoint — an attack that, at the time, raised no alarm.
- Learn the durable practices: what to log, what not to log, how to protect logs, and how monitoring turns a passive tape into timely detection.
Estimated time: 10 to 15 minutes.
Note: this is primarily a defensive, blue-team lesson. There is no exploit to fire. The skill being trained is reading telemetry and reasoning about detection.
Prerequisite: complete captcha-rate-limiting-anti-automation before this lesson — that lesson demonstrates the automated attack pattern you will now learn to detect from the defensive side.
Course position: this follows the captcha-rate-limiting-anti-automation idea from the other side. A burst of failed logins should be prevented by rate limits and detected by monitoring. The evidence discipline practised here — reading a log, identifying an indicator, and naming what should have been alerted — connects directly to the vulnerability-reporting-cvss lesson, where findings like this one are structured into a formal penetration-testing report.
When you are ready, send the Continue signal.