# Splunk Pentesting

### Default Credentials

```txt
admin:changeme
```

\\

### SPL (Search Processing Language)

In Splunk, click **Search & Reporting**. Maybe we need to set the **“All time”** Preset on the right of the search form.\
The cheat sheet of searching is below:

```bash
# "main" index stores all the processed data
index="main" earliest=0
```

#### Files

```sh
index=main example.aspx sourcetype="<SourceType>"
```

#### EventCode

```sh
# EventCode 8: CreateRemoteThread in sysmon.
index="main" sourcetype="<SourceType>" EventCode=8

# EventCode 11: FileCreate in sysmon.
index="main" sourcetype="<SourceType>" EventCode=11
```

#### IP Addresses

```sh
index=main SourceIp=172.* AND DestinationIp=192.68.*
```

#### SourceType

```sh
index="main" sourcetype="<SourctType>"

# Identify all SourceType
index="main" earliest=0 | stats count by sourcetype | sort -count
```

#### Account Name

```sh
index=main AccountName = John AND AccountName != SYSTEM
```

#### Retrieving Hashes

```sh
# Retrieve MD5 hash of the target image
index="main" sourcetype="<SourceType>" Image="c:\\Path\\to\\file.exe" md5
```

#### Filtering by Commands

```sh
index="main" sourcetype="<SourceType>" CommandLine="*/add*"
```

#### Filtering Fields

```sh
index=main | field host, User, SourceIp, DestinationIp
```

#### Table

Create a table.

```sh
index=main | table User, Hostname
```

#### Head/Tail

```sh
# Display the first N results
index=main | head 5

# Display the last N results.
index=main | tail 5
```

#### Reverse

Reverse the result order.

```sh
index=main | reverse
```

#### Sort

Order the result fields in ascending or descending order.

```sh
index=main | table EventID Hostname | sort EventID
```

#### Top/Rare

```sh
# Display top N result of frequent
index=main | top limit=10 User

# Display top N result of the least
index=main | rare limit=10 User
```

#### Chart

Transform the result to chart.

```sh
index=main | chart count by Image

# time-series chart
index=main | timechart count by Image
```

#### Removing Duplicate Fields

```sh
index=main | table User, Hostname | dedup User
```

#### Rename the Field

```sh
index=main | fields host, User | rename User as Member
```

#### Misc

```sh
# Retrive file locations and number of files.
index="main" sourcetype="<SourceType>" EventCode=11 | stats count by TargetFilename

# Client-server method "POST" and search by file formats
index="main" sourcetype="iis" cs_method="POST" | search *.php* OR *.asp* OR *.aspx* OR *.jsp*
```
