> For the complete documentation index, see [llms.txt](https://insecurecodes.gitbook.io/tryhackme/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://insecurecodes.gitbook.io/tryhackme/extra/advent-of-cyber-2022/day-2.md).

# Day 2

### Use the ls command to list the files present in the current directory. How many log files are present?

```bash
ls |wc -l
```

{% hint style="info" %}
2
{% endhint %}

### Elf McSkidy managed to capture the logs generated by the web server. What is the name of this log file?

{% hint style="info" %}
webserver.log
{% endhint %}

### On what day was Santa's naughty and nice list stolen?

Inside the webserver.log we can identify that the attacks happened on `18.11.2022` meaning:

{% hint style="info" %}
Friday
{% endhint %}

### What is the IP address of the attacker?<br>

<figure><img src="https://4240011651-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FY8yH06HVJIl4HpfImeXb%2Fuploads%2F3KJooEqubtCRwMq2FP7S%2Fimage.png?alt=media&amp;token=1d545298-a718-4288-8442-9319931bdffd" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
10.10.249.191
{% endhint %}

### What is the name of the important list that the attacker stole from Santa?

Search for `Santa` and `List` with grep results in:

```bash
grep "santa" webserver.log |grep list
```

{% hint style="info" %}
santaslist.txt
{% endhint %}

### Look through the log files for the flag. The format of the flag is: THM{}

```bash
grep -ri "thm{" .
```

r -> recursive

i -> ignore case

. -> local folder

{% hint style="info" %}
THM{STOLENSANTASLIST}
{% endhint %}

<br>