Unit 3: Searching and pipes · Lesson 4 of 6 · 20 min
Patterns with regular expressions
Use grep -E and -o to pull fields out of an application log and spot a password guessing run.
mission
- You are
- You are on call for the shop API.
- Situation
- Checkout failed for some customers this morning, and the login page threw warnings. The API log is in the lab on the right, a shell that runs in your browser.
- Goal
- Pull out errors and login failures with patterns and decide what happened.
- Hand in
- The error count, the address behind the failed logins and what it did next.
Build a pattern
2026-10-14T11:40:11Z WARN login failed user=ana ip=203.0.113.9 2026-10-14T10:03:38Z ERROR POST /api/checkout status=500 ms=2039 ip=198.51.100.210
2 matches. Group 1: 203.0.113.9, 198.51.100.210
Pattern pieces
| Command | What it does |
|---|---|
[0-9] | One digit |
[0-9]+ | One or more digits |
[0-9]{4} | Exactly four digits |
(GET|POST) | Either word |
[^ ]+ | Anything up to the next space |
Count the errors
grep -c ERROR app.log 6 grep -E 'status=5[0-9]{2}' app.log | grep -oE '(GET|POST) [^ ]+' | sort | uniq -c 5 POST /api/checkout
you should see Every 500 is on checkout. The sixth ERROR line is a database timeout behind it.
Rank the failed logins
-o prints only the part that matched, so you can rank a single field.
grep -c 'login failed' app.log 18 grep 'login failed' app.log | grep -oE 'ip=[0-9.]+' | sort | uniq -c | sort -rn 14 ip=203.0.113.9 1 ip=198.51.100.210 1 ip=192.0.2.87 1 ip=192.0.2.35 1 ip=192.0.2.171
you should see Real people fail once. Fourteen failures in under a minute is a script guessing passwords.
Did it get in?
grep 203.0.113.9 app.log | grep -v 'login failed'
2026-10-14T11:40:29Z INFO POST /api/login status=200 ms=41 ip=203.0.113.9
2026-10-14T11:40:33Z INFO GET /api/orders status=200 ms=88 ip=203.0.113.9
you should see A successful login right after the guessing, then a request for orders. That account is compromised.
defender tip Next steps for the team: reset the account, check which orders were read, and rate-limit the login endpoint.
What a defender takes away
- 1grep -E unlocks ranges, counts and alternatives.
- 2grep -o extracts one field for ranking.
- 3Failures followed by a success from the same address is the pattern to escalate.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.