Security Logging & Alerting Failures

The attack happened. Nobody noticed - or the logs could not be trusted.

## 1 · why it happens

Attackers rarely succeed on the first try. Recon, failed logins and probing leave a trail - if you log it and someone is alerted. Most breaches are discovered weeks later, by someone else.

Logs can also be attacked: user input written straight into a log can fake log lines, and logs that contain passwords or tokens become a target themselves.

# JavaScript

✗ vulnerable

console.log('Login failed for ' + req.body.username);
// username = "bob\nINFO Login success for admin" → forged line
console.log('Login body', req.body);  // logs the password

✓ fixed

logger.warn({ event: 'login_failed', username: req.body.username, ip: req.ip });
// structured JSON: newlines stay inside the value, no secrets logged
// + alert on N failures per IP / per account

# C#

✗ vulnerable

_logger.LogInformation("Login failed for " + username);

✓ fixed

_logger.LogWarning("Login failed for {Username} from {Ip}", username, ip);
// structured logging: the value is a field, not part of the message

## 2 · how attackers find it from outside

public source	what it tells them
Your own recon	Run the OSINT and scans from this site against yourself: did any alert fire? If not, an attacker's recon would not be noticed either.

→ all OSINT sources · run them on yourself

## 3 · how it's abused

⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.

username=bob%0d%0aINFO Login success for admin

CRLF / log injection: a newline in the input creates a fake log entry.

## 4 · fix

Log security events: logins, failures, access denied, admin actions, input validation failures.
Use structured logging; never log passwords, tokens or full card numbers.
Send logs somewhere the app server cannot delete them.
Alert on patterns (many failures, new admin, scan-like traffic) - logs nobody reads do not count.

## 5 · detect

No scanner finds this one for you. Detection here is about your own logging and alerting - use the checklist above, then run self-recon and check whether anything alerted.

Official description: OWASP A09:2025 Security Logging & Alerting Failures