ANALYSIS OF BRUTE FORCE ATTACK LOGS TOWARD NGINX WEB SERVER ON DASHBOARD IMPROVED LOG LOGGING SYSTEM USING FORENSIC INVESTIGATION METHOD - Rio Pradana Aji; Yudi Prayudi; Ahmad Luthfi (Informatika, Universitas Jenderal Soedirman, 2023)
Since it was first launched in 1990, the Web Server is still in use today. No exception, almost all companies entering industry 4.0 use Web Servers to show the existence of the company's website and its products. Starting from the websites provided for free by WordPress and Blogspot to independent websites created by their respective companies. The web server itself is available in several types, ranging from apache, nginx, litespeed, etc. Of course, the use of a Web Server for websites cannot be separated from internet crimes or cyber crimes. One of the crimes committed is the hacker's attempt to login to the website Administrator page. The loophole used by hackers is brute force or forced entry by trying every combination of existing Administrator User and Password. This research focuses on building and updating a website monitoring dashboard system with Wazuh technology. The method used in this study is the Quantitative Forensic Investigation Method by examining the logs generated by the System Dashboard using Digital Forensic procedures. This monitoring process aims to detect brute force threats on managed websites by showing the website Administrator login activity log. The results of the metadata log shown by the optimized dashboard show the number of brute force attacks on managed websites. The number of attacks recorded was 259646 attacks on the first cluster and 288676 attacks on the second cluster. In addition, the results of the metadata log can be investigated further to find the location of the Hacker. The location of the hackers found was only limited to the VPN (Virtual Private Network) server used. One of the VPN servers used in this case is Amazon Data Center.