High severityHARDEC6 steps · 5 phases
Public-Facing Application / Web Compromise
Incident response for compromise of an internet-facing application/server (web shell, RCE, exploited CVE).
Information note
Informational note: In internet-facing web application breaches, look beyond OWASP Top 10 vulnerabilities; server-side template injection, insecure direct object reference, and broken access control application logic flaws are frequently overlooked. Correlate WAF logs, web server access logs, and application error traces to identify the attack origin point. After a breach, always investigate for webshell presence (MITRE T1505.003) and evidence of back-end database access.
1
Preparation
1 steps- WAF + logging + patch management
WAF, centralized web/application logs, asset inventory, rapid patching process.
2
Detection & Analysis
1 steps- Find the entry point
Exploited vulnerability (CVE/0-day), web shell, unauthorized access, affected data/hosts.
3
Containment, Eradication & Recovery
2 steps- Isolate the server
Remove server from traffic/take snapshot, block web shell, rotate exposed secrets.
- Close the vulnerability
Remove web shell/backdoor, patch/fix configuration for the vulnerability, clean persistence, reset identities.
4