Int 8: ️ Database Forensics MySQL - Menganalisis Binary Log untuk Rekonstruksi Query

cd ~ && mkdir forensics-int8 && cd forensics-int8

# 1. Simulasi binary log
python3 << 'PYEOF'
# Binary log events (simulasi format mysqlbinlog)
events = [
    ("#080001", "2026-06-18 08:00:00", "Connect", "root@localhost on bank_db"),
    ("#080002", "2026-06-18 08:00:05", "Query", "SELECT COUNT(*) FROM nasabah"),  # Cek jumlah data
    ("#080003", "2026-06-18 08:05:00", "Query", "SELECT * FROM nasabah WHERE no_ktp = '3201xxxxxxxxxxxxx'"),
    ("#080004", "2026-06-18 08:10:00", "Query", "SELECT * FROM transaksi LIMIT 1000"),
    ("#080005", "2026-06-18 08:15:00", "Query", "SELECT * FROM kartu_kredit"),  # 🚩 Akses tabel sensitif!
    ("#080006", "2026-06-18 08:20:00", "Query", "SELECT * FROM nasabah INTO OUTFILE '/tmp/exfil.csv'"),  # 🚩🚩 EXPORT!
    ("#080007", "2026-06-18 08:21:00", "Query", "DELETE FROM access_log"),  # 🚩 Hapus log akses!
    ("#080008", "2026-06-18 08:22:00", "Query", "DROP TABLE audit_trail"),  # 🚩 Hapus tabel audit!
]

print("=== MySQL Binary Log Analysis ==*")
print(f"{'Pos':<12} {'Waktu':<22} {'Event':<10} {'SQL'}")
print("-"*90)

for pos, ts, event, sql in events:
    sus = " ← 🚩" if any(k in sql.upper() for k in ['INTO OUTFILE', 'DELETE', 'DROP', 'kartu_kredit']) else ""
    print(f"{pos:<12} {ts:<22} {event:<10} {sql[:45]}{sus}")
PYEOF

# 2. Analisis query mencurigakan
echo ""
echo "=== 🚩 Query Mencurigakan ==*"
echo "  08:15:00 - SELECT * FROM kartu_kredit (akses data sensitif)"
echo "  08:20:00 - SELECT INTO OUTFILE '/tmp/exfil.csv' (DATA EXPORT!)"
echo "  08:21:00 - DELETE FROM access_log (bersihkan jejak)"
echo "  08:22:00 - DROP TABLE audit_trail (hancurkan bukti)"
echo ""

# 3. Timeline rekonstruksi
echo "=== Rekonstruksi ==*"
echo "  08:00 - Koneksi ke database (user: root)"
echo "  08:05 - Cek nasabah spesifik (recon)"
echo "  08:10 - Lihat transaksi (intel gathering)"
echo "  08:15 - Akses kartu kredit (target utama)"
echo "  08:20 - Export data ke file CSV (DATA THEFT!)"
echo "  08:21-22 - Hapus log & audit trail (COVER TRACKS)"