Who Clicked

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 10 of 43.

Opening a fake sign-in page and entering a password on it are different actions. To find out who actually sent their password, you need to check Lumen's web logs. WEB_GET records a page visit. WEB_POST records a form being sent:

seclab logs --event WEB_POST

You should see:

2026-10-19 10:13:02 proxy WEB_POST user=lee ip=198.51.100.23 https://beanly.test/orders

This example shows Lee sending a form to Beanly's real orders page, which is normal work. A WEB_POST event alone does not prove that a password was stolen. You also need to check where the form went.

If an employee sent a password form to the fake sign-in page, reset that employee's password. Someone who only opened the email has not necessarily shared their password.

Challenge

Easy

Ticket from Sam, IT lead

The fake mailbox email reached seven people before you pulled it. Find who typed their password into the fake page, and reset exactly those people. A reset costs each person half an hour with IT, so nobody else.

Try it yourself

Terminal

Who Clicked

All lessons in Security Fundamentals