THM - Logless Hunt

A writeup for the room “Logless Hunt” on TryHackMe

Detect every attack step on a Windows machine even after threat actors cleared Security logs.

Logless Hunt

Task 3 - Initial Access | Web Access Logs

What is the title of the HR01-SRV web app hosted on 80 port?

It is enough to visit the page from the machine to obtain the title of the web app.

Which IP performed an extensive web scan on the HR01-SRV web app?

We can take a look at the access.log file of the Apache web server.

Get-Content C:\Apache24\logs\access.log

We can notice many requests from the same IP to multiple destinations on the same path, but with different…