WAF and Database Forensics

What it is

A web application firewall (WAF) filters HTTP traffic to a web application and logs what it blocks. Databases hold the data attackers want and keep logs of how it was used. Both are evidence sources for web attacks and data theft.

The exam asks what a WAF can and cannot do, how SQL Server and MySQL store data, which logs and tables help, and which MySQL utilities fit a task.

How it works

Web application firewall

A WAF works at layer 7. It inspects requests and responses for patterns of attacks such as SQL injection, cross site scripting and file inclusion. Deployment modes are reverse proxy, transparent bridge, and embedded in the web server (for example ModSecurity), plus cloud WAF services.

Two security models exist. A negative model blocks known bad patterns. A positive model allows only known good requests and is stricter but needs more tuning. The OWASP Core Rule Set is a common rule set for ModSecurity.

Benefits and limitations of WAF

For an investigator the WAF log is useful: it shows the time, client address, URI, matched rule ID and action. A block is evidence of an attempt, not of success. Check the web server and database logs to learn whether anything got through.

Data storage in SQL Server

The transaction log records data changes and is the key source for reconstructing activity. Under the Full recovery model it is kept until backed up, which allows point in time reconstruction. Other sources are the SQL Server error log, the default trace, SQL Server Audit, Agent job history, and Windows event logs.

Two read only queries show live state:

SELECT name, create_date FROM sys.databases;
SELECT session_id, login_name, host_name, program_name, login_time FROM sys.dm_exec_sessions;

The second lists current sessions. Collect volatile information such as sessions first, then take copies of files or a backup. Detaching a database to copy it changes it, so a snapshot or backup is safer.

Database evidence repositories

Evidence sits in many places: data files, transaction and redo logs, backups, configuration files, audit logs, error and query logs, memory and cache, temporary tables, application logs that hold queries, and connection logs on the network and server. Deleted rows may remain in unallocated pages or logs until reused.

MySQL forensics

On Linux the data directory is typically /var/lib/mysql. The InnoDB engine uses ibdata1, per table .ibd files, redo logs and undo logs. MyISAM uses .MYD (data) and .MYI (index) files, with .frm for table definitions in older versions.

Many logs are off by default, so ask which were enabled. The mysql system database holds accounts and privileges.

Viewing the information schema

The information_schema database is read only metadata about the server: schemas, tables, columns, privileges and processes.

SELECT table_schema, table_name, create_time
FROM information_schema.tables
WHERE table_schema NOT IN ('mysql','information_schema','performance_schema','sys');

This lists user tables with creation times. SHOW FULL PROCESSLIST; shows current connections and queries.

MySQL utility programs

Example, reading changes within a time window:

mysqlbinlog --start-datetime="2026-10-14 01:00:00" --stop-datetime="2026-10-14 03:00:00" binlog.000001

A worked example

A WAF log shows blocked SQL injection attempts from one address at 01:40. The MySQL general query log shows a UNION SELECT statement executed at 01:52 from the web account.

The WAF blocked early variants, but one request got through. The general query log and any audit log show which data was queried, while the binary log records only changes. The investigator preserves the logs and hashes the copies.

How the exam asks about this

• "Which SQL Server file contains the transaction log?" → The .ldf file.
• "Which MySQL tool reads binary log files?" → mysqlbinlog.
• "Which WAF model allows only known good requests?" → The positive security model.